Win7 dauernd Ladekreis an Maus

Cherdy · 28.04.2014, 20:35

Hi,

wie bereits im Titel beschrieben, dreht sich andauernd mein Ladekreis neben der Maus nicht immer durchgehend aber sehr häufig und meist so für 10-20sek obwohl eigentlich kaum was läuft an Anwendungen.
Kann das ein Virus sein oder vllt ein Problem von nem Windowsupdate?

Hab vor ca 15. Tagen den Virenscanner gewechselt von Free Avira zu Free Avast - dachte eigentlich der ist besser. Der Pc ist erst ein Halbesjahr und ich surfe eigentlich so gut wie nicht.

Was vllt noch wichtig ist - ich habe vorgestern meine Drucker wieder installiert und dabei eprint eingerichtet - drucken übers Netzwerk .. könnt ja sein dass es dort ne Sicherheitslücke gibt?

Also was mache ich denn jetz am Besten?

---
Edit: OK es ist tatsächlich der Drucker , es wird andauernd der Prozess HPNetwork neugestartet und dann wieder geschlossen - allerdings weiß niemand wie man das deaktiviert - habt ihr ne Idee?

Grüße

Cherdy

M-K-D-B · 29.04.2014, 14:46

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 4 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Cherdy · 29.04.2014, 16:11

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2014
Ran by Michael Schwörer (administrator) on MS_PC on 29-04-2014 17:05:03
Running from C:\Users\Michael Schwörer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
() C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Siemens PLM Software Inc.) C:\Program Files\Siemens\PLMLicenseServer\ugslmd.exe
(AMD) C:\Windows\system32\atieclxx.exe
() C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe
(D-Link Corp.) C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Windows\sysWOW64\wbem\wmiprvse.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5510 series\Bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [D-Link D-Link Wireless N DWA-140] => C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe [1079600 2013-01-29] (D-Link Corp.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-03] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-13] (AVAST Software)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-12-31] (Microsoft Corporation)
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [Fatal1tySTU] => [X]
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [ASRockHDMISwitch] => [X]
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [HP Photosmart 5510 series (NET)] => C:\Program Files\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe [2672488 2011-05-25] (Hewlett-Packard Co.)
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day0] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day1] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day2] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day3] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day4] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day5] - 0x00000000
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\RunOnce: [AsrOMG_Day6] - 0x00000000
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com/?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP1CC92CB3-DF4D-4D92-9B20-161D2D02A3B5&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x57183A046A05CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1CC92CB3-DF4D-4D92-9B20-161D2D02A3B5&q={searchTerms}&SSPV=
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1CC92CB3-DF4D-4D92-9B20-161D2D02A3B5&q={searchTerms}&SSPV=
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default
FF SelectedSearchEngine: Google
FF Homepage: https://www.facebook.com/
FF Keyword.URL: hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&fr=linkury-tb&installDate=23/01/2014&type=hp1000&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: anonymoX - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\client@anonymox.net.xpi [2014-01-04]
FF Extension: Adblock Plus - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-04]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-13]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

==================== Services (Whitelisted) =================

R2 ASRockIOMon; C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-13] (AVAST Software)
R2 D-Link Wireless N DWA-140_WPS; C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe [53248 2010-07-12] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 Siemens PLM License Server; C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe [1830736 2013-01-18] (Flexera Software LLC.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

R1 anodlwf; C:\Windows\System32\DRIVERS\anodlwfx.sys [15872 2011-02-21] ()
R3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2013-12-30] (ASRock Incorporation)
S3 AsrHidFilter; C:\Windows\System32\DRIVERS\AsrHidFilter.sys [20232 2013-09-09] (ASRock Inc.)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-13] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-13] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-31] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
R3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [1617472 2011-04-28] (Ralink Technology Corp.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-29 17:05 - 2014-04-29 17:05 - 00017297 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00000000 ____D () C:\FRST
2014-04-29 17:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-29 17:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-29 17:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-29 17:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-29 17:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-29 17:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-29 17:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-29 17:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-29 17:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-29 17:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-29 17:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-29 17:01 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 17:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 17:01 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-29 17:01 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-29 17:01 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-29 17:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-29 17:01 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-29 17:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-29 17:01 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-29 17:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-29 17:01 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-29 16:55 - 2014-04-29 16:56 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-27 12:11 - 2014-04-29 17:01 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:10 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:10 - 2011-05-25 17:44 - 00778088 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMa111.dll
2014-04-27 12:09 - 2014-04-27 12:12 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-15 21:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-14 17:26 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 __RHD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-13 10:56 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-04-13 10:39 - 2014-04-29 17:04 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:21 - 2014-04-13 10:31 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:34 - 2014-03-24 20:00 - 00127488 _____ () C:\Windows\system32\ff_vfw.dll
2014-04-12 20:34 - 2014-03-24 20:00 - 00112640 _____ () C:\Windows\SysWOW64\ff_vfw.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00257624 _____ () C:\Windows\system32\unrar64.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00218200 _____ () C:\Windows\SysWOW64\unrar.dll
2014-04-12 20:34 - 2013-03-17 20:22 - 03554304 _____ (x264vfw project) C:\Windows\system32\x264vfw64.dll
2014-04-12 20:34 - 2013-03-17 19:21 - 03649536 _____ (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2014-04-12 20:34 - 2012-07-21 13:55 - 00180736 _____ (fccHandler) C:\Windows\system32\ac3acm.acm
2014-04-12 20:34 - 2012-07-21 13:54 - 00122880 _____ (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2014-04-12 20:34 - 2011-12-07 20:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2014-04-12 20:34 - 2011-12-07 20:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2014-04-12 20:34 - 2011-06-24 17:45 - 00258560 _____ () C:\Windows\system32\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:44 - 00243200 _____ () C:\Windows\SysWOW64\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:31 - 00703488 _____ () C:\Windows\system32\xvidcore.dll
2014-04-12 20:34 - 2011-06-24 17:28 - 00650752 _____ () C:\Windows\SysWOW64\xvidcore.dll
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-10 16:22 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 16:22 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 16:22 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 16:22 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 16:22 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 16:22 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 16:22 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 16:22 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 16:22 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-02 16:07 - 2014-04-02 16:43 - 00000000 ____D () C:\The KMPlayer

==================== One Month Modified Files and Folders =======

2014-04-29 17:05 - 2014-04-29 17:05 - 00017297 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00000000 ____D () C:\FRST
2014-04-29 17:04 - 2014-04-13 10:39 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 17:03 - 2013-12-30 22:59 - 00003056 _____ () C:\Windows\System32\Tasks\AsrKM
2014-04-29 17:03 - 2013-12-30 22:59 - 00002996 _____ () C:\Windows\System32\Tasks\HDMISwitch
2014-04-29 17:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-29 17:03 - 2009-07-14 06:51 - 00033311 _____ () C:\Windows\setupact.log
2014-04-29 17:03 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-29 17:03 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-29 17:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-29 17:02 - 2013-12-29 21:07 - 01178010 _____ () C:\Windows\WindowsUpdate.log
2014-04-29 17:01 - 2014-04-27 12:11 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-04-29 16:56 - 2014-04-29 16:55 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-29 16:51 - 2009-07-14 19:58 - 00770534 _____ () C:\Windows\system32\perfh007.dat
2014-04-29 16:51 - 2009-07-14 19:58 - 00174350 _____ () C:\Windows\system32\perfc007.dat
2014-04-29 16:51 - 2009-07-14 07:13 - 01798866 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-28 22:17 - 2014-03-22 11:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-28 22:16 - 2014-01-04 02:01 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-28 22:10 - 2014-01-04 02:03 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\PMB Files
2014-04-28 22:10 - 2014-01-04 02:03 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-28 21:54 - 2014-01-05 14:16 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\TS3Client
2014-04-28 21:39 - 2014-01-05 14:13 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Skype
2014-04-28 13:55 - 2013-12-30 16:36 - 00238730 _____ () C:\Windows\PFRO.log
2014-04-27 12:12 - 2014-04-27 12:09 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:12 - 2013-12-29 21:07 - 00000000 ___RD () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-18 23:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-15 21:55 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-15 21:43 - 2014-04-14 17:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-15 21:41 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 22:03 - 2013-12-30 16:23 - 00110904 _____ () C:\Users\Michael Schwörer\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-14 22:03 - 2009-07-14 06:45 - 00419880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:35 - 2014-01-05 14:13 - 00000000 ____D () C:\ProgramData\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:33 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:29 - 2014-04-14 17:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:29 - 2009-07-14 20:18 - 00000000 ____D () C:\Windows\ShellNew
2014-04-14 17:29 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-04-14 17:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 __RHD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-14 17:23 - 2013-12-29 21:07 - 00000000 ____D () C:\Users\Michael Schwörer
2014-04-13 11:15 - 2014-03-22 11:14 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-13 11:15 - 2013-12-31 02:38 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-13 11:15 - 2013-12-31 02:38 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:31 - 2014-04-13 10:21 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-12 14:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 23:11 - 2013-12-30 23:57 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 23:11 - 2013-12-30 23:57 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-02 16:43 - 2014-04-02 16:07 - 00000000 ____D () C:\The KMPlayer
2014-04-02 16:35 - 2014-01-04 20:53 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-03-31 09:35 - 2014-04-13 10:56 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-30 11:14 - 2013-12-31 00:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Michael Schwörer\AppData\Local\Temp\ANPDApi.dll
C:\Users\Michael Schwörer\AppData\Local\Temp\avgnt.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\COMAP.EXE
C:\Users\Michael Schwörer\AppData\Local\Temp\nsb7DFB.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\nsg42A1.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\nsl5335.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\nsl54BC.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\nsr410B.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\PIPInstaller_PTV_.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\setup__3862.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Michael Schwörer\AppData\Local\Temp\sfextra.dll
C:\Users\Michael Schwörer\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Michael Schwörer\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Michael Schwörer\AppData\Local\Temp\_isB0B8.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 12:47

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2014
Ran by Michael Schwörer at 2014-04-29 17:05:17
Running from C:\Users\Michael Schwörer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires III (HKLM-x32\...\InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AMD Accelerated Video Transcoding (Version: 13.10.100.30604 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0604.1838.31590 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6F936DD-DD80-7EA6-0AFC-5CA0558D0BB7}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.80604.1838 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.12 - Advanced Micro Devices, Inc.) Hidden
ASRock HDMI Switch v1.0.25 (HKLM-x32\...\ASRock HDMI Switch_is1) (Version: 1.0.25 - )
ASRock Key Master v1.0.7 (HKLM-x32\...\ASRock Key Master_is1) (Version: 1.0.7 - )
ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2016 - Avast Software)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version:  - Microsoft)
D-Link DWA-140 (HKLM-x32\...\{D7D2F494-89E3-42ED-8A2B-75BDD9B464CB}) (Version:  - D-Link)
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
F-Stream Tuning v2.0.48 (HKLM-x32\...\F-Stream Tuning_is1) (Version: 2.0.48 - )
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations)
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{AB6268C0-EDA4-46C3-8A1C-11D86A5A8E93}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 5510 series Hilfe (HKLM-x32\...\{E02964EA-0E1B-4620-A26E-CBAB0341B1BB}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Network Connections 18.5.54.0 (Version: 18.5.54.0 - Intel) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Mega Codec Pack 10.4.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.0 - )
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mirror's Edge (HKLM-x32\...\Steam App 17410) (Version:  - DICE)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)
Siemens NX 9.0 (HKLM\...\{CAE1D783-E86C-4144-B0E3-8D2485019B11}) (Version: 9.0.0.19 - Siemens)
Siemens PLM License Server (HKLM-x32\...\Siemens PLM License Server) (Version: 6.1.1.3 - Siemens Product Lifecycle Management Software Inc.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Tomb Raider (HKLM-x32\...\Steam App 203160) (Version:  - Crystal Dynamics)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (01/19/2011 1.0.0009.0) (HKLM\...\4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20) (Version: 01/19/2011 1.0.0009.0 - Western Digital Technologies)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Restore Points  =========================

15-04-2014 14:55:15 Windows Update
15-04-2014 19:38:12 Windows Update
22-04-2014 14:52:45 Windows Update
29-04-2014 14:54:02 Windows Update
29-04-2014 15:01:49 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {49F83407-3663-42B2-AE13-0B58B227AFE9} - System32\Tasks\HDMISwitch => C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe [2013-09-04] ()
Task: {99570A1D-012B-4623-B522-AAE0C6023876} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-13] (AVAST Software)
Task: {9FA915B6-84DE-48C2-A9F2-1088116C32B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-13] (Adobe Systems Incorporated)
Task: {C9DF20C2-E4A1-4542-AE28-F61327E070DF} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: {ECDD3A46-8812-4EAE-AEFD-3BC65AD10C88} - System32\Tasks\AsrKM => C:\Program Files (x86)\ASRock Utility\Key Master\AsrKM.exe [2013-09-11] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe

==================== Loaded Modules (whitelisted) =============

2013-12-30 22:59 - 2013-05-28 18:58 - 00454656 _____ () C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
2013-12-30 16:14 - 2010-07-12 15:39 - 00053248 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
2013-12-30 22:59 - 2013-09-04 18:26 - 02217224 _____ () C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2014-04-29 16:47 - 2014-04-29 16:47 - 02252800 _____ () C:\Program Files\AVAST Software\Avast\defs\14042801\algo.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2013-12-30 16:15 - 2013-12-30 16:15 - 00315392 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANPDApi.dll
2013-12-30 16:14 - 2012-12-05 11:40 - 00303104 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\WlanApp.dll
2014-04-13 10:39 - 2014-04-13 10:39 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang) (User: )
Description: Programm DeviceSetup.exe, Version 24.0.342.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 17fc

Startzeit: 01cf631b4b13e7a2

Endzeit: 6

Anwendungspfad: C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe

Berichts-ID:

Error: (04/28/2014 09:45:22 PM) (Source: Application Hang) (User: )
Description: Programm FSTU.exe, Version 2.0.48.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 136c

Startzeit: 01cf631a0261f833

Endzeit: 20

Anwendungspfad: C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exe

Berichts-ID: a18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb

Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/22/2014 09:56:51 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 48c

Startzeit: 01cf5e64d46df306

Endzeit: 1

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb

Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall


System errors:
=============
Error: (04/29/2014 05:03:15 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/29/2014 04:46:12 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/28/2014 09:16:58 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/28/2014 01:55:43 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/27/2014 00:18:13 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 43. Der interne Fehlerstatus lautet: 252.

Error: (04/27/2014 11:54:41 AM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/27/2014 11:38:18 AM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (04/26/2014 08:37:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/26/2014 08:37:18 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (04/26/2014 11:41:33 AM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.


Microsoft Office Sessions:
=========================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang)(User: )
Description: DeviceSetup.exe24.0.342.017fc01cf631b4b13e7a26C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe

Error: (04/28/2014 09:45:22 PM) (Source: Application Hang)(User: )
Description: FSTU.exe2.0.48.0136c01cf631a0261f83320C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exea18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb

Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/22/2014 09:56:51 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.048c01cf5e64d46df3061C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb

Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall


==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 8111.47 MB
Available physical RAM: 6687.66 MB
Total Pagefile: 8109.65 MB
Available Pagefile: 6516.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (SSD ) (Fixed) (Total:111.69 GB) (Free:34.49 GB) NTFS
Drive d: (HDD) (Fixed) (Total:931.51 GB) (Free:875.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: B7DB1726)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 199A1823)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M-K-D-B · 29.04.2014, 19:26

Servus,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Cherdy · 01.05.2014, 11:03

Code:

ATTFilter

ComboFix 14-04-30.01 - Michael Schwörer 01.05.2014  11:49:42.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8111.6709 [GMT 2:00]
ausgeführt von:: c:\users\Michael Schw÷rer\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-01 bis 2014-05-01  ))))))))))))))))))))))))))))))
.
.
2074-05-07 17:38 . 2006-11-21 19:48	203576	------w-	c:\program files (x86)\Microsoft Games\Age of Empires III\autopatcher2.exe
2014-05-01 09:54 . 2014-05-01 09:54	--------	d-----w-	c:\users\DefaultAppPool\AppData\Local\temp
2014-05-01 09:54 . 2014-05-01 09:54	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-29 15:05 . 2014-04-29 15:05	--------	d-----w-	C:\FRST
2014-04-29 15:01 . 2014-03-06 10:21	23549440	----a-w-	c:\windows\system32\mshtml.dll
2014-04-29 14:54 . 2014-04-17 03:31	10651704	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{2567CD62-352E-4C66-8E9E-C201EDDA8CED}\mpengine.dll
2014-04-27 10:11 . 2014-04-27 10:11	--------	d-----w-	c:\program files (x86)\HP Photo Creations
2014-04-27 10:11 . 2014-04-27 10:11	--------	d-----w-	c:\programdata\HP Photo Creations
2014-04-27 10:10 . 2014-04-30 19:00	--------	d-----w-	c:\users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-27 10:10 . 2011-05-25 15:44	778088	------w-	c:\windows\system32\HPDiscoPMa111.dll
2014-04-27 10:10 . 2014-04-27 10:10	--------	d-----w-	c:\programdata\HP
2014-04-27 10:10 . 2014-04-27 10:10	--------	d-----w-	c:\program files (x86)\HP
2014-04-27 10:09 . 2014-04-27 10:09	--------	d-----w-	c:\program files\HP
2014-04-27 10:09 . 2014-04-27 10:12	--------	d-----w-	c:\users\Michael Schwörer\AppData\Local\HP
2014-04-15 19:39 . 2014-04-15 19:39	--------	d-----w-	c:\users\Default\AppData\Local\Microsoft Help
2014-04-14 15:35 . 2014-04-14 15:35	--------	d-----w-	c:\users\Michael Schwörer\AppData\Local\Skype
2014-04-14 15:35 . 2014-04-14 15:35	--------	d-----r-	c:\program files (x86)\Skype
2014-04-14 15:35 . 2014-04-14 15:35	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-04-14 15:29 . 2014-04-14 15:29	--------	d-----w-	c:\program files (x86)\Microsoft Synchronization Services
2014-04-14 15:29 . 2014-04-14 15:29	--------	d-----w-	c:\windows\PCHEALTH
2014-04-14 15:29 . 2014-04-14 15:29	--------	d-----w-	c:\program files (x86)\Microsoft Sync Framework
2014-04-14 15:29 . 2014-04-14 15:29	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 15:27 . 2014-04-14 15:27	--------	d-----w-	c:\program files (x86)\Microsoft Visual Studio 8
2014-04-14 15:27 . 2014-04-14 15:27	--------	d-----w-	c:\program files\Microsoft Office
2014-04-14 15:27 . 2014-04-14 15:27	--------	d-----w-	c:\program files (x86)\Microsoft Analysis Services
2014-04-14 15:26 . 2014-04-14 15:26	--------	d-----w-	c:\users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 15:26 . 2014-04-15 19:43	--------	d-----w-	c:\programdata\Microsoft Help
2014-04-14 15:26 . 2014-04-14 15:26	--------	d-----r-	C:\MSOCache
2014-04-14 15:23 . 2014-04-14 15:23	--------	d-----w-	c:\users\Michael Schwörer\Tracing
2014-04-14 15:23 . 2014-04-14 15:23	--------	d-----w-	c:\program files (x86)\OCSetup
2014-04-13 08:56 . 2014-03-31 07:35	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-04-13 08:39 . 2014-04-13 08:39	--------	d-----w-	c:\users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 08:39 . 2014-04-13 08:39	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-04-13 08:39 . 2014-04-13 08:39	84816	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-04-13 08:39 . 2014-04-13 08:39	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-04-13 08:39 . 2014-04-13 08:39	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-04-13 08:39 . 2014-04-13 08:39	43152	----a-w-	c:\windows\avastSS.scr
2014-04-13 08:39 . 2014-04-13 08:39	423240	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-04-13 08:39 . 2014-04-13 08:39	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-13 08:39 . 2014-04-13 08:39	208928	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-04-13 08:39 . 2014-04-13 08:39	1039096	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-04-13 08:38 . 2014-04-13 08:38	--------	d-----w-	c:\program files\AVAST Software
2014-04-13 08:38 . 2014-04-13 08:38	--------	d-----w-	c:\programdata\AVAST Software
2014-04-12 15:30 . 2014-04-12 15:30	--------	d-----w-	c:\program files (x86)\SpeedFan
2014-04-05 12:43 . 2014-04-05 12:43	--------	d-----w-	c:\programdata\Western Digital
2014-04-05 12:42 . 2014-04-05 12:42	--------	d-----w-	c:\program files\DIFX
2014-04-05 12:41 . 2014-04-05 12:41	--------	d-----w-	c:\program files\WDCSAM
2014-04-03 19:05 . 2014-04-03 19:05	--------	d-----w-	c:\program files\Microsoft Silverlight
2014-04-03 19:05 . 2014-04-03 19:05	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2014-04-02 14:07 . 2014-04-02 14:43	--------	d-----w-	C:\The KMPlayer
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-29 15:19 . 2013-12-31 00:38	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-29 15:19 . 2013-12-31 00:38	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-10 21:11 . 2013-12-30 21:57	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-03-04 09:17 . 2014-04-10 14:22	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-02-07 01:23 . 2014-03-14 16:54	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-14 16:49	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-14 16:49	624128	----a-w-	c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-14 16:49	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-14 16:49	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-01-31 17:26 . 2014-01-31 17:26	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-31 16:45 . 2014-01-31 16:45	283064	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-01-22 21:29	294456	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"D-Link D-Link Wireless N DWA-140"="c:\program files (x86)\D-Link\DWA-140 revB\AirNCFG.exe" [2013-01-29 1079600]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-09-03 134616]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-04-26 292848]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-06-04 676608]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-13 3854640]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
.
c:\users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Photosmart 5510 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN18U057G805NR;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 ASRockIOMon;ASRock IO Monitor Service;c:\program files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe;c:\program files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AsrHidFilter;AsrHidFilter;c:\windows\system32\DRIVERS\AsrHidFilter.sys;c:\windows\SYSNATIVE\DRIVERS\AsrHidFilter.sys [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S0 AsrRamDisk;AsrRamDisk;c:\windows\system32\DRIVERS\AsrRamDisk.sys;c:\windows\SYSNATIVE\DRIVERS\AsrRamDisk.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 anodlwf;ANOD Network Security Filter driver;c:\windows\system32\DRIVERS\anodlwfx.sys;c:\windows\SYSNATIVE\DRIVERS\anodlwfx.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 D-Link Wireless N DWA-140_WPS;D-Link Wireless N DWA-140_WPS Service;c:\program files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe;c:\program files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 Siemens PLM License Server;Siemens PLM License Server;c:\program files\Siemens\PLMLicenseServer\lmgrd.exe;c:\program files\Siemens\PLMLicenseServer\lmgrd.exe [x]
S3 AsrDrv101;AsrDrv101;c:\windows\SysWOW64\Drivers\AsrDrv101.sys;c:\windows\SysWOW64\Drivers\AsrDrv101.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs	REG_MULTI_SZ   	w3svc was
apphost	REG_MULTI_SZ   	apphostsvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-31 15:19]
.
2014-04-30 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-01-22 21:29	357432	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-13 08:39	290888	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-07-26 13636824]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com/?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP1CC92CB3-DF4D-4D92-9B20-161D2D02A3B5&SSPV=
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=23/01/2014&type=hp1000
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&fr=linkury-tb&installDate=23/01/2014&type=hp1000&p=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Fatal1tySTU - (no file)
Wow6432Node-HKCU-Run-ASRockHDMISwitch - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-01  11:59:59
ComboFix-quarantined-files.txt  2014-05-01 09:59
.
Vor Suchlauf: 12 Verzeichnis(se), 36.823.322.624 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 39.906.844.672 Bytes frei
.
- - End Of File - - C9C4CBC7F8730D0852383FE51AC6E70D
A36C5E4F47E84449FF07ED3517B43A31

M-K-D-B · 01.05.2014, 13:18

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/

Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen können.
Starte die zoek.exe mit einem Doppelklick.
Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und sollte nicht 1:1 auf andere Computer übernommen werden.
Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
Code:
ATTFilter
```
FFdefaults;
CHRdefaults;
iedefaults;
emptyclsid;
autoclean;
         
```
Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Schritt 4
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.
Setze dazu einen Haken bei Addition.txt rechts unten und klicke auf Scan.
Es werden zwei Logdateien erzeugt. Poste mir diese.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von Zoek,
die beiden neuen Logdateien von FRST.

Cherdy · 01.05.2014, 13:19

Hi,

kurze zwischenfrage - ist das denn wirklich alles nötig? Wenn ich doch sicher weiß , das es der Drucker ist?

M-K-D-B · 01.05.2014, 13:22

Zitat:

Zitat von Cherdy

kurze zwischenfrage - ist das denn wirklich alles nötig? Wenn ich doch sicher weiß , das es der Drucker ist?

Dein Rechner ist mit Adware infiziert...

Cherdy · 01.05.2014, 13:25

Aber Adware ist doch "nur" Werbung oder nicht? btw: wo infiziert man sich damit?

Das Problem mit dem Drucker ist dann aber noch nicht erledigt oder

M-K-D-B · 01.05.2014, 13:32

Zitat:

Zitat von Cherdy

Aber Adware ist doch "nur" Werbung oder nicht? btw: wo infiziert man sich damit?

Wenn du einen versifften Rechner haben willst... deine Entscheidung.

Zitat:

Zitat von Cherdy

Das Problem mit dem Drucker ist dann aber noch nicht erledigt oder

Komplette HP Software deinstallieren und neu installieren...

Noch Fragen?

Cherdy · 01.05.2014, 13:37

Hmm , ist eig nicht versifft zumindest merke ich bewusst nix von irgendwelcher Adware

Ehm bei dem Adwrecleaner wurde nach einiger Zeit nichts vorgeschlagen ich habe dann trotzdem auf Löschen geklickt hier mal den SLog - wozu ist eigentlidch der R Log ?^^

Code:

ATTFilter

# AdwCleaner v3.205 - Bericht erstellt am 01/05/2014 um 14:34:35
# Aktualisiert 28/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Michael Schwörer - MS_PC
# Gestartet von : C:\Users\Michael Schwörer\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Windows\SysWOW64\AI_RecycleBin
Ordner Gelöscht : C:\Users\Michael Schwörer\AppData\Roaming\OpenCandy
Datei Gelöscht : C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\searchplugins\conduit-search.xml
Datei Gelöscht : C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\searchplugins\Web Search.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v29.0 (de)

[ Datei : C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\prefs.js ]

Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=33f56456-4ab7-0591-fc6f-94eb925caf75&searchtype=ds&fr=linkury-tb&installDate=23/01/2014&type=hp1000&p="[...]

*************************

AdwCleaner[R0].txt - [4931 octets] - [01/05/2014 14:33:40]
AdwCleaner[S0].txt - [3694 octets] - [01/05/2014 14:34:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3754 octets] ##########

Edit-

kann ich die Deinstallation von der HP Software jezt zwischendurch durchführen?

Und soll ich die anderen Scans auch noch machen?:>

M-K-D-B · 01.05.2014, 13:42

Zitat:

Zitat von Cherdy

kann ich die Deinstallation von der HP Software jezt zwischendurch durchführen?

Und soll ich die anderen Scans auch noch machen?:>

Mach halt bitte noch kurz die Scans... die dauern ja nicht lange.
Danach HP... dann Rückmeldung, wie es läuft.

Cherdy · 01.05.2014, 14:12

Also hier noch

mbam

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 01.05.2014
Suchlauf-Zeit: 14:53:57
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.1.1004
Malware Datenbank: v2014.05.01.07
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Michael SchwÃ¶rer

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 307609
Verstrichene Zeit: 5 Min, 12 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

zoek

Code:

ATTFilter

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Michael Schw”rer on 01.05.2014 at 15:01:32,28.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\MICHAE~1\Desktop\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

01.05.2014 15:02:03 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.facebook.com/");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted
C:\PROGRA~3\Package Cache deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [13.04.2014 10:39]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{B64D9B05-48E1-4CEB-BF58-E0643994E900}"="C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff" [23.01.2014 11:50]

==== Firefox Extensions ======================

ProfilePath: C:\Users\MICHAE~1\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default
- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
- Adblock Plus Pop-up Addon - %ProfilePath%\extensions\adblockpopups@jessehakanen.net.xpi
- anonymoX - %ProfilePath%\extensions\client@anonymox.net.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://www.google.com"
"SearchAssistant"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=134 folders=37 28726807 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\temp emptied successfully
C:\Users\Michael Schwörer\AppData\Local\Temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\MICHAE~2\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\MICHAE~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 01.05.2014 at 15:08:49,50 ======================

und frst

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2014
Ran by Michael Schwörer (administrator) on MS_PC on 01-05-2014 15:10:26
Running from C:\Users\Michael Schwörer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
() C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Flexera Software LLC.) C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe
(Siemens PLM Software Inc.) C:\Program Files\Siemens\PLMLicenseServer\ugslmd.exe
() C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(D-Link Corp.) C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5510 series\bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [D-Link D-Link Wireless N DWA-140] => C:\Program Files (x86)\D-Link\DWA-140 revB\AirNCFG.exe [1079600 2013-01-29] (D-Link Corp.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-03] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-13] (AVAST Software)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3953501866-2536193060-1674005732-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
Startup: C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x57183A046A05CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: anonymoX - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\client@anonymox.net.xpi [2014-01-04]
FF Extension: Adblock Plus - C:\Users\Michael Schwörer\AppData\Roaming\Mozilla\Firefox\Profiles\z2rnc989.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-04]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-13]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

==================== Services (Whitelisted) =================

R2 ASRockIOMon; C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-13] (AVAST Software)
R2 D-Link Wireless N DWA-140_WPS; C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe [53248 2010-07-12] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 Siemens PLM License Server; C:\Program Files\Siemens\PLMLicenseServer\lmgrd.exe [1830736 2013-01-18] (Flexera Software LLC.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]

==================== Drivers (Whitelisted) ====================

R1 anodlwf; C:\Windows\System32\DRIVERS\anodlwfx.sys [15872 2011-02-21] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2013-12-30] (ASRock Incorporation)
S3 AsrHidFilter; C:\Windows\System32\DRIVERS\AsrHidFilter.sys [20232 2013-09-09] (ASRock Inc.)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-13] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-13] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-13] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-13] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-13] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-31] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
R3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [1617472 2011-04-28] (Ralink Technology Corp.)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-01 15:10 - 2014-05-01 15:10 - 00013686 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer\AppData\Roaming\Macromedia
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer
2014-05-01 15:08 - 2014-05-01 15:01 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-01 15:01 - 2014-05-01 15:08 - 00007394 _____ () C:\zoek-results.log
2014-05-01 15:01 - 2014-05-01 15:07 - 00000000 ____D () C:\zoek_backup
2014-05-01 15:00 - 2014-05-01 15:00 - 01285120 _____ () C:\Users\Michael Schwörer\Desktop\zoek.exe
2014-05-01 15:00 - 2014-05-01 15:00 - 00001160 _____ () C:\Users\Michael Schwörer\Desktop\mbam.txt
2014-05-01 14:47 - 2014-05-01 14:48 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 14:47 - 2014-05-01 14:47 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-01 14:47 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-01 14:47 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-01 14:47 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-01 14:43 - 2014-05-01 14:44 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Michael Schwörer\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 14:33 - 2014-05-01 14:34 - 00000000 ____D () C:\AdwCleaner
2014-05-01 14:31 - 2014-05-01 14:31 - 01310621 _____ () C:\Users\Michael Schwörer\Desktop\adwcleaner.exe
2014-05-01 12:00 - 2014-05-01 12:00 - 00017786 _____ () C:\ComboFix.txt
2014-05-01 11:48 - 2014-05-01 12:00 - 00000000 ____D () C:\Qoobox
2014-05-01 11:48 - 2014-05-01 11:58 - 00000000 ____D () C:\Windows\erdnt
2014-05-01 11:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-01 11:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-01 11:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-01 11:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-01 11:47 - 2014-05-01 11:47 - 05197895 ____R (Swearware) C:\Users\Michael Schwörer\Desktop\ComboFix.exe
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 17:05 - 2014-05-01 15:10 - 00000000 ____D () C:\FRST
2014-04-29 17:05 - 2014-04-29 17:05 - 00048194 _____ () C:\Users\Michael Schwörer\Desktop\FRST1.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00029880 _____ () C:\Users\Michael Schwörer\Desktop\Addition1.txt
2014-04-29 17:02 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-29 17:02 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-29 17:02 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-29 17:02 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 17:02 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-29 17:02 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-29 17:02 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-29 17:02 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-29 17:02 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-29 17:02 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-29 17:02 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-29 17:02 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-29 17:02 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-29 17:02 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-29 17:02 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-29 17:02 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-29 17:02 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-29 17:02 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-29 17:02 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-29 17:01 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 17:01 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 17:01 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-29 17:01 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-29 17:01 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-29 17:01 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-29 17:01 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-29 17:01 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-29 17:01 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-29 17:01 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-29 17:01 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-29 17:01 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-29 17:01 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-29 17:01 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-29 17:01 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-29 17:01 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-29 16:55 - 2014-04-29 16:56 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-27 12:11 - 2014-05-01 15:01 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:10 - 2014-04-30 21:00 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-27 12:10 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:10 - 2011-05-25 17:44 - 00778088 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMa111.dll
2014-04-27 12:09 - 2014-04-27 12:12 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-15 21:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-14 17:26 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ___RD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-13 10:56 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-04-13 10:39 - 2014-04-29 17:04 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:21 - 2014-04-13 10:31 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:34 - 2014-03-24 20:00 - 00127488 _____ () C:\Windows\system32\ff_vfw.dll
2014-04-12 20:34 - 2014-03-24 20:00 - 00112640 _____ () C:\Windows\SysWOW64\ff_vfw.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00257624 _____ () C:\Windows\system32\unrar64.dll
2014-04-12 20:34 - 2013-12-01 15:10 - 00218200 _____ () C:\Windows\SysWOW64\unrar.dll
2014-04-12 20:34 - 2013-03-17 20:22 - 03554304 _____ (x264vfw project) C:\Windows\system32\x264vfw64.dll
2014-04-12 20:34 - 2013-03-17 19:21 - 03649536 _____ (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2014-04-12 20:34 - 2012-07-21 13:55 - 00180736 _____ (fccHandler) C:\Windows\system32\ac3acm.acm
2014-04-12 20:34 - 2012-07-21 13:54 - 00122880 _____ (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2014-04-12 20:34 - 2011-12-07 20:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2014-04-12 20:34 - 2011-12-07 20:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2014-04-12 20:34 - 2011-06-24 17:45 - 00258560 _____ () C:\Windows\system32\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:44 - 00243200 _____ () C:\Windows\SysWOW64\xvidvfw.dll
2014-04-12 20:34 - 2011-06-24 17:31 - 00703488 _____ () C:\Windows\system32\xvidcore.dll
2014-04-12 20:34 - 2011-06-24 17:28 - 00650752 _____ () C:\Windows\SysWOW64\xvidcore.dll
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-10 16:22 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 16:22 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 16:22 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 16:22 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 16:22 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 16:22 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 16:22 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 16:22 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 16:22 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 16:22 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 16:22 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-02 16:07 - 2014-04-02 16:43 - 00000000 ____D () C:\The KMPlayer

==================== One Month Modified Files and Folders =======

2014-05-01 15:10 - 2014-05-01 15:10 - 00013686 _____ () C:\Users\Michael Schwörer\Desktop\FRST.txt
2014-05-01 15:10 - 2014-04-29 17:05 - 00000000 ____D () C:\FRST
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer\AppData\Roaming\Macromedia
2014-05-01 15:08 - 2014-05-01 15:08 - 00000000 ____D () C:\Users\Michael Schw÷rer
2014-05-01 15:08 - 2014-05-01 15:01 - 00007394 _____ () C:\zoek-results.log
2014-05-01 15:08 - 2013-12-30 22:59 - 00003056 _____ () C:\Windows\System32\Tasks\AsrKM
2014-05-01 15:08 - 2013-12-30 22:59 - 00002996 _____ () C:\Windows\System32\Tasks\HDMISwitch
2014-05-01 15:08 - 2013-12-30 16:36 - 00239906 _____ () C:\Windows\PFRO.log
2014-05-01 15:08 - 2013-12-29 21:07 - 01282103 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 15:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-01 15:08 - 2009-07-14 06:51 - 00034444 _____ () C:\Windows\setupact.log
2014-05-01 15:07 - 2014-05-01 15:01 - 00000000 ____D () C:\zoek_backup
2014-05-01 15:01 - 2014-05-01 15:08 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-01 15:01 - 2014-04-27 12:11 - 00000278 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2014-05-01 15:01 - 2014-01-04 02:01 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-01 15:00 - 2014-05-01 15:00 - 01285120 _____ () C:\Users\Michael Schwörer\Desktop\zoek.exe
2014-05-01 15:00 - 2014-05-01 15:00 - 00001160 _____ () C:\Users\Michael Schwörer\Desktop\mbam.txt
2014-05-01 14:48 - 2014-05-01 14:47 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 14:47 - 2014-05-01 14:47 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-01 14:47 - 2014-05-01 14:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-01 14:44 - 2014-05-01 14:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Michael Schwörer\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-01 14:42 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 14:42 - 2009-07-14 06:45 - 00015120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-01 14:40 - 2009-07-14 19:58 - 00770534 _____ () C:\Windows\system32\perfh007.dat
2014-05-01 14:40 - 2009-07-14 19:58 - 00174350 _____ () C:\Windows\system32\perfc007.dat
2014-05-01 14:40 - 2009-07-14 07:13 - 01798866 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-01 14:34 - 2014-05-01 14:33 - 00000000 ____D () C:\AdwCleaner
2014-05-01 14:31 - 2014-05-01 14:31 - 01310621 _____ () C:\Users\Michael Schwörer\Desktop\adwcleaner.exe
2014-05-01 14:31 - 2014-01-05 14:13 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Skype
2014-05-01 14:17 - 2014-03-22 11:14 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 13:06 - 2014-01-04 02:03 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\PMB Files
2014-05-01 12:00 - 2014-05-01 12:00 - 00017786 _____ () C:\ComboFix.txt
2014-05-01 12:00 - 2014-05-01 11:48 - 00000000 ____D () C:\Qoobox
2014-05-01 11:58 - 2014-05-01 11:48 - 00000000 ____D () C:\Windows\erdnt
2014-05-01 11:54 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-01 11:52 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-01 11:47 - 2014-05-01 11:47 - 05197895 ____R (Swearware) C:\Users\Michael Schwörer\Desktop\ComboFix.exe
2014-05-01 00:11 - 2014-01-04 02:03 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-30 21:00 - 2014-04-27 12:10 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\HpUpdate
2014-04-30 20:50 - 2014-01-05 14:16 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\TS3Client
2014-04-30 19:21 - 2013-12-31 00:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-29 20:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-29 17:19 - 2014-03-22 11:14 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 17:19 - 2013-12-31 02:38 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 17:19 - 2013-12-31 02:38 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 17:05 - 2014-04-29 17:05 - 00048194 _____ () C:\Users\Michael Schwörer\Desktop\FRST1.txt
2014-04-29 17:05 - 2014-04-29 17:05 - 00029880 _____ () C:\Users\Michael Schwörer\Desktop\Addition1.txt
2014-04-29 17:04 - 2014-04-13 10:39 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 17:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-29 16:56 - 2014-04-29 16:55 - 02061824 _____ (Farbar) C:\Users\Michael Schwörer\Desktop\FRST64.exe
2014-04-27 12:12 - 2014-04-27 12:09 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\HP
2014-04-27 12:12 - 2013-12-29 21:07 - 00000000 ___RD () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-27 12:11 - 2014-04-27 12:11 - 00003160 _____ () C:\Windows\System32\Tasks\HP Photo Creations Messager
2014-04-27 12:11 - 2014-04-27 12:11 - 00002011 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:11 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-04-27 12:11 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00002216 _____ () C:\Users\Public\Desktop\HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001888 _____ () C:\Users\Public\Desktop\HP ePrintCenter - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00001184 _____ () C:\Users\Public\Desktop\Zubehör einkaufen - HP Photosmart 5510 series.lnk
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\ProgramData\HP
2014-04-27 12:10 - 2014-04-27 12:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-04-27 12:09 - 2014-04-27 12:09 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-04-27 12:09 - 2014-04-27 12:09 - 00000000 ____D () C:\Program Files\HP
2014-04-18 23:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-15 21:55 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-15 21:43 - 2014-04-14 17:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-15 21:41 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-04-15 21:39 - 2014-04-15 21:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-04-14 22:03 - 2013-12-30 16:23 - 00110904 _____ () C:\Users\Michael Schwörer\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-14 22:03 - 2009-07-14 06:45 - 00419880 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-14 17:35 - 2014-04-14 17:35 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Skype
2014-04-14 17:35 - 2014-04-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-14 17:35 - 2014-01-05 14:13 - 00000000 ____D () C:\ProgramData\Skype
2014-04-14 17:34 - 2014-04-14 17:34 - 00003095 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft PowerPoint 2010.lnk
2014-04-14 17:34 - 2014-04-14 17:34 - 00003047 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Excel 2010.lnk
2014-04-14 17:33 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-04-14 17:30 - 2014-04-14 17:30 - 00003029 _____ () C:\Users\Michael Schwörer\Desktop\Microsoft Word 2010.lnk
2014-04-14 17:30 - 2014-04-14 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Windows\PCHEALTH
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-04-14 17:29 - 2014-04-14 17:29 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-04-14 17:29 - 2014-04-14 17:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-04-14 17:29 - 2009-07-14 20:18 - 00000000 ____D () C:\Windows\ShellNew
2014-04-14 17:29 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-04-14 17:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-04-14 17:27 - 2014-04-14 17:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ___RD () C:\MSOCache
2014-04-14 17:26 - 2014-04-14 17:26 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Local\Microsoft Help
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Users\Michael Schwörer\Tracing
2014-04-14 17:23 - 2014-04-14 17:23 - 00000000 ____D () C:\Program Files (x86)\OCSetup
2014-04-14 17:23 - 2013-12-29 21:07 - 00000000 ____D () C:\Users\Michael Schwörer
2014-04-13 10:39 - 2014-04-13 10:39 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-13 10:39 - 2014-04-13 10:39 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-13 10:39 - 2014-04-13 10:39 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-13 10:39 - 2014-04-13 10:39 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\AVAST Software
2014-04-13 10:39 - 2014-04-13 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-13 10:38 - 2014-04-13 10:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-13 10:31 - 2014-04-13 10:21 - 88551496 _____ (AVAST Software) C:\Users\Michael Schwörer\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-04-12 20:34 - 2014-04-12 20:34 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-04-12 20:29 - 2014-04-12 20:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\K Lite Mega Codec Pack - CHIP-Downloader.exe
2014-04-12 17:30 - 2014-04-12 17:30 - 00001015 _____ () C:\Users\Michael Schwörer\Desktop\SpeedFan.lnk
2014-04-12 17:30 - 2014-04-12 17:30 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 17:30 - 2014-04-12 17:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 17:29 - 2014-04-12 17:29 - 00613200 _____ (Chip Digital GmbH) C:\Users\Michael Schwörer\Downloads\SpeedFan - CHIP-Downloader.exe
2014-04-10 23:11 - 2013-12-30 23:57 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 23:11 - 2013-12-30 23:57 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-05 14:43 - 2014-04-05 14:43 - 02112847 _____ () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater.zip
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WDFirmwareUpdater
2014-04-05 14:43 - 2014-04-05 14:43 - 00000000 ____D () C:\ProgramData\Western Digital
2014-04-05 14:42 - 2014-04-05 14:42 - 00000000 ____D () C:\Program Files\DIFX
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Users\Michael Schwörer\Downloads\WD_SES_Driver_Setup_x64
2014-04-05 14:41 - 2014-04-05 14:41 - 00000000 ____D () C:\Program Files\WDCSAM
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 21:05 - 2014-04-03 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-03 09:51 - 2014-05-01 14:47 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-05-01 14:47 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-05-01 14:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 16:43 - 2014-04-02 16:07 - 00000000 ____D () C:\The KMPlayer
2014-04-02 16:35 - 2014-01-04 20:53 - 00000000 ____D () C:\Users\Michael Schwörer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 20:46

==================== End Of Log ============================

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2014
Ran by Michael Schwörer at 2014-05-01 15:10:41
Running from C:\Users\Michael Schwörer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires III (HKLM-x32\...\InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AMD Accelerated Video Transcoding (Version: 13.10.100.30604 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.0604.1838.31590 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6F936DD-DD80-7EA6-0AFC-5CA0558D0BB7}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.80604.1838 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.12 - Advanced Micro Devices, Inc.) Hidden
ASRock HDMI Switch v1.0.25 (HKLM-x32\...\ASRock HDMI Switch_is1) (Version: 1.0.25 - )
ASRock Key Master v1.0.7 (HKLM-x32\...\ASRock Key Master_is1) (Version: 1.0.7 - )
ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2016 - Avast Software)
Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0604.1837.31590 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0604.1838.31590 - Advanced Micro Devices, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version:  - Microsoft)
D-Link DWA-140 (HKLM-x32\...\{D7D2F494-89E3-42ED-8A2B-75BDD9B464CB}) (Version:  - D-Link)
Free YouTube Download version 3.2.20.1230 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.20.1230 - DVDVideoSoft Ltd.)
F-Stream Tuning v2.0.48 (HKLM-x32\...\F-Stream Tuning_is1) (Version: 2.0.48 - )
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations)
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{AB6268C0-EDA4-46C3-8A1C-11D86A5A8E93}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 5510 series Hilfe (HKLM-x32\...\{E02964EA-0E1B-4620-A26E-CBAB0341B1BB}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Network Connections 18.5.54.0 (Version: 18.5.54.0 - Intel) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Mega Codec Pack 10.4.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.0 - )
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mirror's Edge (HKLM-x32\...\Steam App 17410) (Version:  - DICE)
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.11.2762 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)
Siemens NX 9.0 (HKLM\...\{CAE1D783-E86C-4144-B0E3-8D2485019B11}) (Version: 9.0.0.19 - Siemens)
Siemens PLM License Server (HKLM-x32\...\Siemens PLM License Server) (Version: 6.1.1.3 - Siemens Product Lifecycle Management Software Inc.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Tomb Raider (HKLM-x32\...\Steam App 203160) (Version:  - Crystal Dynamics)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (01/19/2011 1.0.0009.0) (HKLM\...\4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20) (Version: 01/19/2011 1.0.0009.0 - Western Digital Technologies)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Restore Points  =========================

22-04-2014 14:52:45 Windows Update
29-04-2014 14:54:02 Windows Update
29-04-2014 15:01:49 Windows Update
01-05-2014 09:48:57 ComboFix created restore point
01-05-2014 13:01:57 zoek.exe restore point

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-05-01 11:54 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0DC469A4-FD51-4744-8D80-08D635E718CD} - System32\Tasks\HDMISwitch => C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe [2013-09-04] ()
Task: {517A960F-E135-41A4-8029-F7EE38FD77E4} - System32\Tasks\AsrKM => C:\Program Files (x86)\ASRock Utility\Key Master\AsrKM.exe [2013-09-11] ()
Task: {99570A1D-012B-4623-B522-AAE0C6023876} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-13] (AVAST Software)
Task: {9FA915B6-84DE-48C2-A9F2-1088116C32B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29] (Adobe Systems Incorporated)
Task: {C9DF20C2-E4A1-4542-AE28-F61327E070DF} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe

==================== Loaded Modules (whitelisted) =============

2013-12-30 22:59 - 2013-05-28 18:58 - 00454656 _____ () C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\IOMonitorSrv.exe
2013-12-30 16:14 - 2010-07-12 15:39 - 00053248 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-12-30 22:59 - 2013-09-04 18:26 - 02217224 _____ () C:\Program Files (x86)\ASRock Utility\HDMISwitch\Bin\HDMISwitch.exe
2014-04-30 23:24 - 2014-04-30 23:24 - 02252800 _____ () C:\Program Files\AVAST Software\Avast\defs\14043002\algo.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2013-12-30 16:15 - 2013-12-30 16:15 - 00315392 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\ANPDApi.dll
2013-12-30 16:14 - 2012-12-05 11:40 - 00303104 _____ () C:\Program Files (x86)\D-Link\DWA-140 revB\WlanApp.dll
2014-04-13 10:39 - 2014-04-13 10:39 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang) (User: )
Description: Programm DeviceSetup.exe, Version 24.0.342.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 17fc

Startzeit: 01cf631b4b13e7a2

Endzeit: 6

Anwendungspfad: C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe

Berichts-ID:

Error: (04/28/2014 09:45:22 PM) (Source: Application Hang) (User: )
Description: Programm FSTU.exe, Version 2.0.48.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 136c

Startzeit: 01cf631a0261f833

Endzeit: 20

Anwendungspfad: C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exe

Berichts-ID: a18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb

Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/22/2014 09:56:51 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 48c

Startzeit: 01cf5e64d46df306

Endzeit: 1

Anwendungspfad: C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb

Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall


System errors:
=============
Error: (05/01/2014 03:08:35 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (05/01/2014 03:07:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 03:07:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 03:07:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 02:35:07 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (05/01/2014 00:01:27 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (05/01/2014 11:54:23 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (05/01/2014 11:52:50 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.


Microsoft Office Sessions:
=========================
Error: (04/28/2014 09:52:17 PM) (Source: Application Hang)(User: )
Description: DeviceSetup.exe24.0.342.017fc01cf631b4b13e7a26C:\Program Files\HP\HP Photosmart 5510 series\Bin\DeviceSetup.exe

Error: (04/28/2014 09:45:22 PM) (Source: Application Hang)(User: )
Description: FSTU.exe2.0.48.0136c01cf631a0261f83320C:\Program Files (x86)\Fatal1ty Utility\F-Stream Tuning\Bin\FSTU.exea18b98fb-cf0d-11e3-99a1-bc5ff4f4a3bb

Error: (04/23/2014 05:26:40 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/22/2014 09:56:51 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.048c01cf5e64d46df3061C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe3db2dbfa-ca58-11e3-b886-bc5ff4f4a3bb

Error: (04/22/2014 06:10:21 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/21/2014 06:42:19 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/20/2014 09:26:55 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/20/2014 01:02:12 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/19/2014 01:29:28 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall

Error: (04/19/2014 02:03:49 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall


CodeIntegrity Errors:
===================================
  Date: 2014-05-01 11:52:50.038
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-01 11:52:49.975
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 8111.47 MB
Available physical RAM: 6723.16 MB
Total Pagefile: 8109.65 MB
Available Pagefile: 6584.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (SSD ) (Fixed) (Total:111.69 GB) (Free:37 GB) NTFS
Drive d: (HDD) (Fixed) (Total:931.51 GB) (Free:878.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 199A1823)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: B7DB1726)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M-K-D-B · 01.05.2014, 16:29

Servus,

ok, sieht gut aus.

Wie siehts mit HP aus?

Cherdy · 01.05.2014, 20:15

War da jetzt viel Adware drauf - und welcher Art?

Habs einfach die ePrint Funktion deinstalliert

01.05.2014, 16:29	#14
M-K-D-B /// TB-Ausbilder	Win7 dauernd Ladekreis an Maus Servus, ok, sieht gut aus. Wie siehts mit HP aus?

Win7 dauernd Ladekreis an Maus

Plagegeister aller Art und deren Bekämpfung: Win7 dauernd Ladekreis an Maus