Moin,

ich habe momentan ein System von den ich denke/hoffe das es sauber ist würde das aber gerne genauer Prüfen.

Grund dafür ist ein (durchaus nicht unberechtigter) Anschiss meiner Hochschul IT...

Ich habe an der Netzwerkinfrastruktur eines Labores etwas geändert und wollte eine Visualisierung der selben machen. Bin dabei auf das Programm The Dude (www.mikrotik.com/thedude) gestossen und dachte mir das währe doch sehr schön das zu Automatisieren...

Dummerweise habe ich dabei (vermutlich durch Fehlbedienung) das gesamte Hochschul Netzwerk lahmgelegt. Nun vermutet die Hochschul IT das ich zusätzlich dazu noch Schadprogramme auf den Rechner habe. Laut deren Logs würde es wohl ein wenig nach einer Tauschbörse aussehen.

Bevor ich jetzt wieder ins Netzwerk gehen darf muss ich mein System sauber kriegen.

The Dude ist wieder deinstaliert und ich habe jetzt schonmal Scans mit Malwarebytes Anti-Malware, Farbar Recovery Scan Tool und GMER durchgeführt. Dabei wurde ein bischen was gefunden aber in meinen Augen nichts das für diese Probleme verantwortlich gewesen sein könnte. Die Logs sind alle unten angehängt.

Ich würde mich freuen wenn ihr mir sagen könnt ob ich einfach nur zu Doof/Unbedarft an die Sache rangegangen bin oder ob ich mir tatsächlich was ernstes eingefangen haben könnte.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 07.05.2014
Scan Time: 21:51:54
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.03.04.09
Rootkit Database: v2014.02.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: 42

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 290675
Time Elapsed: 23 min, 45 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 1
PUP.Optional.Conduit.A, HKU\S-1-5-21-2964411297-4113465080-1101347880-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=),Replaced,[ce7ba15e7efcc670a9020e177292af51]

Folders: 2
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86], 
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86], 

Files: 8
PUP.Optional.Conduit.A, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4\SSStub_SearchProtect_p1v0.exe, Quarantined, [0e3b12edbbbf70c62b518fcf9968e41c], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsr59C8.exe, Quarantined, [cd7ca35c7ffba393df75f67536cb718f], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw56DA.exe, Quarantined, [361324dbc1b9ee48243003683fc2f10f], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw70C2.exe, Quarantined, [8fba26d9700a37ff054fd7945ba63bc5], 
PUP.Optional.Somoto, C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe, Quarantined, [1d2c609f90ea72c4f4e3a5cf43bd06fa], 
PUP.Optional.ShowPass.A, C:\Users\42\AppData\Local\Temp\Show-Password_1030-8102.exe, Quarantined, [f851d7289edc2f070c8be2b0659c46ba], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm430C.exe, Quarantined, [0445c53a74067cbae66ef77423de639d], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm7391.exe, Quarantined, [08418f704b2f23131d37cd9efd0408f8], 

Physical Sectors: 0
(No malicious items detected)


(end)
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-05-2014
Ran by 42 at 2014-05-07 23:56:18
Running from C:\Users\42\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

==================== Installed Programs ======================

3Dconnexion 3DxSoftware (x64 Edition) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 3.17.8 - 3Dconnexion)
3Dconnexion 3DxWare (x64) (Version: 6.17.0008 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2014 (Version: 1.12.4 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion) Hidden
7-PDF Printer 10.0.0.1840 (HKLM\...\7-PDF Printer_is1) (Version: 10.0.0.1840 - 7-PDF, Germany - Th. Hodes)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
AutoCAD Electrical 2014 - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
AutoCAD Electrical 2014 Language Pack - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
Autodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)
Autodesk App Manager (HKLM-x32\...\{C070121A-C8C5-4D52-9A7D-D240631BD433}) (Version: 1.1.0 - Autodesk)
Autodesk AutoCAD Electrical 2014 - Deutsch (German) (HKLM\...\AutoCAD Electrical 2014 - Deutsch (German)) (Version: 11.0.57.0 - Autodesk)
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Download Manager (HKLM-x32\...\{2F48C80C-3A76-495A-A4B5-C0CC946FEEBD}) (Version: 2.0.6.0 - Autodesk, Inc.)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
Autodesk Featured Apps (HKLM-x32\...\{F732FEDA-7713-4428-934B-EF83B8DD65D0}) (Version: 1.1.0 - Autodesk)
Autodesk Inventor Content Center Libraries 2014 (Desktop Content) (HKLM\...\{B46DECD1-1864-4EF1-0000-22D71E81877C}) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Fusion 2013 R1 (HKLM\...\Autodesk Inventor Fusion 2013 R1) (Version: 3.0.0.5 - Autodesk, Inc.)
Autodesk Inventor Fusion 2013 R1 (Version: 3.0.0.5 - Autodesk, Inc.) Hidden
Autodesk Inventor Professional 2014 - Deutsch (German) (HKLM\...\Autodesk Inventor Professional 2014) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Professional 2014 (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2014 Language Pack - Deutsch (German) (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2014 (HKLM-x32\...\{5C29CC1F-218F-4C30-948A-11066CAC59FB}) (Version: 4.0.19.0 - Autodesk)
Autodesk ReCap (HKLM\...\Autodesk ReCap) (Version: 1.0.43.27 - Autodesk)
Autodesk ReCap (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk ReCap Language Pack-English (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk Revit Interoperability for Inventor 2014 (HKLM\...\Autodesk Revit Interoperability for Inventor 2014) (Version: 13.02.15161 - Autodesk)
Autodesk Revit Interoperability for Inventor 2014 (Version: 13.02.15161 - Autodesk) Hidden
Autodesk Simulation Mechanical 2014 (HKLM\...\Autodesk Simulation Mechanical 2014) (Version: 2014.00.00.0513 - Autodesk, Inc.)
Autodesk Simulation Mechanical 2014 (Version: 2014.00.00.0513 - Autodesk, Inc.) Hidden
Autodesk Vault Basic 2014 (Client) (HKLM\...\Autodesk Vault Basic 2014 (Client)) (Version: 18.0.86.0 - Autodesk)
Autodesk Vault Basic 2014 (Client) (Version: 18.0.86.0 - Autodesk) Hidden
Autodesk Vault Basic 2014 (Client) German Language Pack (Version: 18.0.86.0 - Autodesk) Hidden
CADE Pro 2.20.3 (HKLM-x32\...\{0D050176-09B9-437C-9E9C-B3E84614D32E}) (Version: 2.20.3 - Weresc)
CIROS Automation Suite Updater (HKLM-x32\...\CIROS Automation Suite Updater5.1) (Version: 5.1 - RIF e.V.)
CIROS Studio (HKLM-x32\...\CIROS Studio5.1) (Version: 5.1 - RIF e.V.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.2.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dungeon Keeper Gold (HKLM-x32\...\GOGPACKDUNGEONKEEPER_is1) (Version: 2.0.0.4 - GOG.com)
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
EasyPort ActiveX Control V2.1 (HKLM-x32\...\EasyPort) (Version:  - )
Eco Materials Adviser for Autodesk Inventor 2014 (64-bit) (HKLM\...\{530B8614-C5DE-475B-AF6F-71BED461552C}) (Version: 4.4.1.0 - Granta Design Limited)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.64.2 - Lenovo Group Limited)
EzOPC V5.4 (HKLM-x32\...\EzOPC 5) (Version:  - )
FARO LS 1.1.501.0 (64bit) (HKLM-x32\...\{8A470330-70B2-49AD-86AF-79885EF9898A}) (Version: 5.1.0.30630 - FARO Scanner Production)
Fresco Logic USB3.0 Host Controller (HKLM\...\{3534A6A6-D6CF-415E-B2C5-E97BEE8A6639}) (Version: 3.0.110.12 - Fresco Logic Inc.)
G I - Die Welt der Verurteilten (mit neuen Texturen) (HKLM-x32\...\G I - Die Welt der Verurteilten (mit neuen Texturen)) (Version: 1.03 - Issues (Deadgame Inc.))
GameRanger (HKCU\...\GameRanger) (Version:  - GameRanger Technologies)
Gothic (HKLM-x32\...\Steam App 65540) (Version:  - Piranha – Bytes )
Gothic II: Gold Edition (HKLM-x32\...\Steam App 39510) (Version:  - Piranha – Bytes)
inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.28.0 (HKLM-x32\...\{A87263E8-26CB-1016-8F2F-C04708B17CE2}) (Version: 1.2.28.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) PRO/Wireless Driver (Version: 16.01.3000.0512 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 16.1.1.0084 - Intel Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{828af006-cb5e-4d60-957a-523098a1b0f8}) (Version: 16.1.3 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.3000.0254 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
LOGO!Soft Comfort V7.0 (Demo) (HKLM\...\LOGO!Soft Comfort V7.0 (Demo)) (Version: 7.0.0.0 - Siemens AG)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
MATLAB R2013a (HKLM\...\Matlab R2013a) (Version: 8.1 - The MathWorks, Inc.)
Max Payne 2 DE (HKLM-x32\...\Steam App 210410) (Version:  - )
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) German (Version: 7.1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 x64 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MiKTeX 2.9 (HKCU\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Miranda IM 0.10.21 (HKLM-x32\...\Miranda IM) (Version: 0.10.21 - Miranda IM Project)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MTpro 3.6 (HKLM-x32\...\MTpro) (Version: 3.6.0.2 - Bosch Rexroth AG)
MTproLight 3.6 (HKLM-x32\...\MTproLight) (Version: 3.6.0.1 - Bosch Rexroth AG)
NETGEAR Print Server Software (HKLM-x32\...\{A3DF5B33-FB8B-43FE-A943-A24CF6030F61}) (Version: 1.0 - NETGEAR)
Network Notepad 4.6.9 (HKLM-x32\...\Netnotep_is1) (Version:  - Jason Green)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
OPC Core Components Redistributable (HKLM-x32\...\{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}) (Version: 3.00.102 - OPC Foundation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PKZIP Server for Windows 12.40.0008 (HKLM-x32\...\{134A51EB-1BBB-4249-BAF5-494C3D186A06}) (Version: 12.40.0008 - PKWARE, Inc)
Railroad Tycoon 2: Platinum (HKLM-x32\...\Steam App 7620) (Version:  - PopTop)
RICOH_Media_Driver_v2.14.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
Rome - Total War - Gold Edition (HKLM-x32\...\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}) (Version: 1.6 - The Creative Assembly)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Serious Sam Classic: The First Encounter (HKLM-x32\...\Steam App 41050) (Version:  - Croteam)
Sid Meier's Railroad Tycoon (HKLM-x32\...\Sid Meier's Railroad Tycoon) (Version: 1.0 - 2K Games)
Siemens Automation License Manager (Version: 05.01.0100 - Siemens AG) Hidden
Siemens Automation License Manager V5.1 + SP1   (HKLM\...\{8D2E0408-8D61-4A53-B0DB-2AD670A38624}LicenseManager) (Version: 05.01.0100 - Siemens AG)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{35002267-F746-4F77-9B97-125305EF65C6}) (Version: 6.2.00 - Silicon Laboratories, Inc.)
SIMATIC  STEP 7 (x32 Version: 05.05.0200 - Siemens AG) Hidden
SIMATIC  STEP 7 V5.5 + SP2 Professional 2010 SR2   (HKLM-x32\...\{7B427E8E-F76D-4C8C-B155-7F24DF46DB67}STEP7) (Version: 05.05.0200 - Siemens AG)
SIMATIC Device Drivers (Version: 01.00.0200 - Siemens AG) Hidden
SIMATIC NCM FWL 64 (Version: 05.05.0100 - Siemens AG) Hidden
SIMATIC PLCSIM 64 (Version: 01.00.0001 - Siemens AG) Hidden
SIMATIC S7-GRAPH (x32 Version: 05.03.0700 - Siemens AG) Hidden
SIMATIC S7-GRAPH V5.3 + SP7 Professional 2010 SR2   (HKLM-x32\...\{4FF24C45-A4EE-4A99-B287-E3468EC41CBD}S7GRAPH) (Version: 05.03.0700 - Siemens AG)
SIMATIC S7-PCT (x32 Version: 02.03.0000 - Siemens AG) Hidden
SIMATIC S7-PCT V2.3 Professional 2010 SR2   (HKLM-x32\...\{06AF0F82-E926-48A6-8C5F-ECB195DB2CB4}S7PCT) (Version: 02.03.0000 - Siemens AG)
SIMATIC S7-PLCSIM (x32 Version: 5.4.0502 - Siemens AG) Hidden
SIMATIC S7-PLCSIM V5.4 + SP5 + Upd2 Professional 2010 SR2   (HKLM-x32\...\{1CBF27F6-24A4-488D-940A-678F1C691C49}PLCSim) (Version: 5.4.0502 - Siemens AG)
SIMATIC S7-SCL (x32 Version: 5.3.6.0 - Siemens AG) Hidden
SIMATIC S7-SCL V5.3 + SP6 Professional 2010 SR2   (HKLM-x32\...\{5B1B0682-EEC6-4EDD-BAB0-3FEC2E55090D}SCL) (Version: 5.3.6.0 - Siemens AG)
SketchUp Import for AutoCAD 2014 (HKLM-x32\...\{644E9589-F73A-49A4-AC61-A953B9DE5669}) (Version: 1.1.0 - Autodesk)
Sophos Anti-Virus (HKLM-x32\...\{4320988A-7DE0-478D-A38B-CE9509BCE320}) (Version: 10.3.1 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{15C418EB-7675-42be-B2B3-281952DA014D}) (Version: 2.9.0.344 - Sophos Limited)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version:  - FireFly Studios)
System Shock 2 (HKLM-x32\...\Steam App 238210) (Version:  - Irrational Games)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.13 - )
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.78.0.11 - Lenovo)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinFACT 7 (HKLM-x32\...\{FE2A7490-32EA-47D1-BCB4-0705F73F4C24}) (Version: 7.1.1 - Ingenieurbüro Dr. Kahlert)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinTrack Demo Version 11.0 3D (HKLM-x32\...\wintrack11demo_is1) (Version: 11.0 3D - Ing.-Büro Schneider)

==================== Restore Points  =========================

18-04-2014 07:40:29 Windows Update
20-04-2014 20:30:17 Windows-Sicherung
22-04-2014 07:33:16 Windows Update
25-04-2014 12:20:11 Windows Update
27-04-2014 17:00:10 Windows-Sicherung
29-04-2014 06:33:26 Windows Update
29-04-2014 07:22:23 Installed Silicon Laboratories CP210x VCP Drivers for Windows XPçtõe
03-05-2014 01:00:35 Windows Update
04-05-2014 17:00:16 Windows-Sicherung
06-05-2014 06:27:30 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {20302771-FF20-42A8-911E-CBACEAE02371} - System32\Tasks\{7CD3D0F3-3B01-4A38-BE70-13ACF72B08C9} => G:\SETUP.EXE
Task: {264116B0-5FEA-452B-B328-616B704A4DBF} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: {417E5AEE-8300-48BE-B97A-4ACC41E5E25E} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {41B89BB8-5482-468F-BA08-E70AD256BF9F} - System32\Tasks\MATLAB R2013a Startup Accelerator => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe [2013-01-16] ()
Task: {53BC6006-F4E8-4B47-A342-C8B4326C9EFB} - System32\Tasks\{4A4FD7AE-BD3F-4ABE-A332-9184D2525CBC} => G:\SETUP.EXE
Task: {AA3710D3-AACA-453B-93E2-D44DAA2FF0CF} - System32\Tasks\{5B5DCE77-D315-4B39-9A9D-747F69CB7657} => G:\SETUP.EXE
Task: {CA215D09-E318-4B3B-8C7B-61F70432D91B} - System32\Tasks\3DconnexionCreateProcess_3DxSRV.EXE => C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxSRV.EXE [2014-01-24] (3Dconnexion, INC)
Task: {DD1FA757-CB08-4457-80C1-A2C8EABAEDA7} - System32\Tasks\{CCACA2F1-B496-447A-A3AA-D1BCE16FE3AD} => G:\SETUP.EXE
Task: {E16447B5-EF15-41A5-A18C-7F807E0088DF} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {EB0E851A-9648-45E4-BB8A-A6D8E241A540} - System32\Tasks\{83941917-908D-4A22-9F0B-A51889FEF570} => G:\SETUP.EXE
Task: {F8C14A5C-CE14-4568-A8B5-DB4AD92630C5} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe

==================== Loaded Modules (whitelisted) =============

2014-01-24 15:04 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-07-26 11:42 - 2013-07-26 11:42 - 00034304 _____ () C:\Windows\System32\ssa3mlm.dll
2014-01-24 15:03 - 2013-10-29 09:17 - 00004096 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-01-24 15:05 - 2013-12-09 07:04 - 00117248 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-03-10 02:43 - 2011-03-10 02:43 - 00774144 _____ () C:\Program Files\Common Files\Siemens\SWS\PlugIns\SCP\Scpwin64.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00824320 _____ () C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\sn_regbase.dll
2014-01-24 15:03 - 2011-09-26 01:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-24 15:13 - 2010-10-26 11:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-02-05 01:21 - 2013-02-05 01:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00749568 _____ () C:\Windows\SysWOW64\sn_regbase.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00057432 _____ () C:\Program Files (x86)\Miranda IM\zlib.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00036961 _____ () C:\Program Files (x86)\Miranda IM\Plugins\dbx_mmap.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00061538 _____ () C:\Program Files (x86)\Miranda IM\Plugins\clist_classic.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00203357 _____ () C:\Program Files (x86)\Miranda IM\Plugins\aim.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00245848 _____ () C:\Program Files (x86)\Miranda IM\Plugins\chat.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00339550 _____ () C:\Program Files (x86)\Miranda IM\Plugins\icq.dll
2014-01-16 00:38 - 2014-01-16 00:38 - 00379993 _____ () C:\Program Files (x86)\Miranda IM\Plugins\irc.dll
2014-01-16 00:41 - 2014-01-16 00:41 - 00090200 _____ () C:\Program Files (x86)\Miranda IM\Plugins\srmm.dll
2014-03-30 18:44 - 2014-03-30 18:44 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-13 16:43 - 2013-07-18 00:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll
2014-02-08 10:40 - 2014-02-08 10:40 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: pdflatex.EXE, Version: 0.0.0.0, Zeitstempel: 0x51c4b8b9
Name des fehlerhaften Moduls: QtGui4.dll, Version: 4.8.4.0, Zeitstempel: 0x50d7557c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001e30d
ID des fehlerhaften Prozesses: 0x2204
Startzeit der fehlerhaften Anwendung: 0xpdflatex.EXE0
Pfad der fehlerhaften Anwendung: pdflatex.EXE1
Pfad des fehlerhaften Moduls: pdflatex.EXE2
Berichtskennung: pdflatex.EXE3

Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: jucheck.exe, Version: 2.1.9.8, Zeitstempel: 0x51d2fcc9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1458
Startzeit der fehlerhaften Anwendung: 0xjucheck.exe0
Pfad der fehlerhaften Anwendung: jucheck.exe1
Pfad des fehlerhaften Moduls: jucheck.exe2
Berichtskennung: jucheck.exe3

Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000021cfa
ID des fehlerhaften Prozesses: 0x10a4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0x28f8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3

Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: pdfprevhndlr.dll, Version: 11.0.3.37, Zeitstempel: 0x518e10a7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000028dd
ID des fehlerhaften Prozesses: 0x18d8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3


System errors:
=============
Error: (05/07/2014 11:49:29 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:49:29 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (05/07/2014 11:49:25 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (05/07/2014 11:33:33 PM) (Source: SCardSvr) (User: ) (EventID: 610)
Description: Das Handle ist ungültig.Lenovo Integrated Smart Card Reader 0GET_STATEXX XX XX XX

Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:30:08 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.


Microsoft Office Sessions:
=========================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: pdflatex.EXE0.0.0.051c4b8b9QtGui4.dll4.8.4.050d7557cc00000050001e30d220401cf68393def472aC:\Program Files (x86)\Neuer Ordner\miktex\bin\pdflatex.EXEC:\Program Files (x86)\Neuer Ordner\miktex\bin\QtGui4.dll911d1c1f-d42c-11e3-91b5-f0def1939b2a

Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: jucheck.exe2.1.9.851d2fcc9unknown0.0.0.000000000c000000500000000145801cf6540b76bc642C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeunknown6a910fa8-d34e-11e3-91b5-f0def1939b2a

Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: explorer.exe6.1.7601.175144ce7a144ntdll.dll6.1.7601.18247521eaf24c00000050000000000021cfa10a401cf654ad6bfadd5C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dllaa9afcff-d1bd-11e3-91b5-f0def1939b2a

Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acntdll.dll6.1.7601.18247521ea8e7c000000500038e1928f801cf6452869486efC:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\ntdll.dll929b1deb-d082-11e3-8f20-f0def1939b2a

Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acpdfprevhndlr.dll11.0.3.37518e10a7c0000005000028dd18d801cf63a390713850C:\Windows\SysWOW64\prevhost.exeC:\Program Files (x86)\Adobe\Reader 11.0\Reader\pdfprevhndlr.dllc1c123f9-d045-11e3-8f20-f0def1939b2a


==================== Memory info =========================== 

Percentage of memory in use: 40%
Total physical RAM: 8075.23 MB
Available physical RAM: 4802.52 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 12527.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:232.79 GB) (Free:108.56 GB) NTFS
Drive d: (Daten) (Fixed) (Total:698.63 GB) (Free:256.89 GB) NTFS
Drive e: (VOYAGER) (Removable) (Total:7.5 GB) (Free:4.2 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 776B0AC9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 8F089F77)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: 04DD5721)
Partition 1: (Active) - (Size=8 GB) - (Type=0B)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-05-2014
Ran by 42 (administrator) on THINKPAD on 07-05-2014 23:56:00
Running from C:\Users\42\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrvlauncher.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DudeServer] => C:\Program Files (x86)\Dude\dude.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: G - G:\Launch.exe
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: {d8c62dfd-84f4-11e3-a90e-c38adcc6c8f1} - G:\shelexec.exe -! "start<CN=*Adobe*:!V!>.pdf" -DefaultApp:<base>\adobe\acrobat5\win\Reader\AcroRd32.exe -QueryApp
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)

==================== Internet (Whitelisted) ====================

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]

==================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-07 23:56 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 23:30 - 2014-05-07 22:01 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-07 23:56 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-07 22:04 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-07 23:49 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-11 14:21 - 2014-04-08 11:31 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-11 14:21 - 2014-04-07 21:14 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
2014-04-11 14:21 - 2014-04-02 14:37 - 00018778 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0.ods
2014-04-10 10:59 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 10:59 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 10:59 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 10:59 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 10:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 10:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 10:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 10:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 10:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 10:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 10:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 10:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 10:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 10:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 09:02 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 09:02 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 09:02 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 09:02 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

==================== One Month Modified Files and Folders =======

2014-05-07 23:56 - 2014-05-07 23:30 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:56 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-07 23:55 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-07 23:55 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-07 23:55 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-07 23:52 - 2014-01-24 14:45 - 01638570 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 23:49 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 23:49 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-07 23:49 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-07 23:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 23:49 - 2009-07-14 06:51 - 00066845 _____ () C:\Windows\setupact.log
2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:04 - 2014-05-07 22:03 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 22:01 - 2014-05-07 23:30 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:52 - 2010-11-21 05:47 - 00026106 _____ () C:\Windows\PFRO.log
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-21 11:29 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-04-17 23:16 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-10 18:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 03:02 - 2014-01-24 16:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:01 - 2014-01-24 16:37 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 01:10 - 2014-01-24 14:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 11:31 - 2014-04-11 14:21 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-07 21:14 - 2014-04-11 14:21 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt

Some content of TEMP:
====================
C:\Users\42\AppData\Local\Temp\AcDeltree.exe
C:\Users\42\AppData\Local\Temp\Ct64Setup.exe
C:\Users\42\AppData\Local\Temp\DLMGuardian.exe
C:\Users\42\AppData\Local\Temp\exie.exe
C:\Users\42\AppData\Local\Temp\expb.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\42\AppData\Local\Temp\Procmon64.exe
C:\Users\42\AppData\Local\Temp\simaticn.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 08:59

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-08 00:06:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Samsung_ rev.EXT0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\42\AppData\Local\Temp\uwlyipog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                             000007fefd8b2db0 5 bytes JMP 000007fffd8a0180
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                        000007fefd8b37d0 7 bytes JMP 000007fffd8a00d8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                          000007fefd8b8ef0 6 bytes JMP 000007fffd8a0148
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                      000007fefd8caf60 5 bytes JMP 000007fffd8a0110
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                       000007feff2289e0 8 bytes JMP 000007fffd8a01f0
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                     000007feff22be40 8 bytes JMP 000007fffd8a01b8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                             000007fef7eedc88 5 bytes JMP 000007fff7ec00d8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                            000007fef7eede10 5 bytes JMP 000007fff7ec0110
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!CopyFileExW                                                                                   00000000778e1890 5 bytes JMP 000000016fff00d8
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW                                                                         000000007795f490 8 bytes JMP 000000016fff0110
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                 000007feff027490 11 bytes JMP 000007fffeff00d8
.text  C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000077691465 2 bytes [69, 77]
.text  C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000077691465 2 bytes [69, 77]
.text  C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000077691465 2 bytes [69, 77]
.text  C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                            0000000077691465 2 bytes [69, 77]
.text  C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                          0000000077691465 2 bytes [69, 77]
.text  C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                         00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher                                                               0000000077be0124 5 bytes JMP 0000000175348620
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                              0000000077c0c4dd 5 bytes JMP 0000000175344e10
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread                                                                       0000000077c2801c 5 bytes JMP 0000000175344ff0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFile                                                                            00000000766e1282 5 bytes JMP 0000000175344e70
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!FreeLibrary                                                                          00000000766e3488 5 bytes JMP 0000000175345240
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtect                                                                       00000000766e4327 5 bytes JMP 0000000175344ed0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA                                                                       00000000766e48db 5 bytes JMP 0000000175344f50
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryW                                                                         00000000766e48f3 5 bytes JMP 0000000175344f10
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW                                                                       00000000766e4925 5 bytes JMP 0000000175344f30
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                         00000000766e499f 5 bytes JMP 0000000175344f70
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateFileA                                                                          00000000766e538e 5 bytes JMP 0000000175345070
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GlobalAlloc                                                                          00000000766e5856 5 bytes JMP 0000000175344f90
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                                          00000000766e79d8 5 bytes JMP 0000000175345010
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA                                                               00000000766fa48f 5 bytes JMP 0000000175345030
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory                                                                   00000000766fd9b0 5 bytes JMP 0000000175344e30
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GetThreadContext                                                                     000000007670799c 5 bytes JMP 0000000175344fb0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx                                                                     0000000076764aff 5 bytes JMP 0000000175344eb0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFileEx                                                                          0000000076764b2f 5 bytes JMP 0000000175344e50
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!SetThreadContext                                                                     00000000767658d3 5 bytes JMP 0000000175344ef0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                         0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                        00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                   00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                             0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2

---- EOF - GMER 2.1 ----
         

Hi,

Dude ist noch da.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Danke schonmal für deine Hilfe!

ComboFix 14-05-07.03 - 42 08.05.2014   8:02.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8075.5323 [GMT 2:00]
ausgeführt von:: c:\users\42\Desktop\ComboFix.exe
AV: Sophos Anti-Virus *Disabled/Updated* {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
SP: Sophos Anti-Virus *Disabled/Updated* {DE9A3984-B0E2-7A61-FD5D-409005EB0337}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\windows\Downloaded Program Files\IDropPTB.dll
c:\windows\SysWow64\Temp
D:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-08 bis 2014-05-08  ))))))))))))))))))))))))))))))
.
.
2014-05-08 06:11 . 2014-05-08 06:11	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-05-08 06:11 . 2014-05-08 06:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-05-07 20:15 . 2014-05-07 20:15	--------	d-----w-	c:\users\42\AppData\Local\Sophos
2014-05-07 20:03 . 2014-05-07 21:56	--------	d-----w-	C:\FRST
2014-05-07 19:28 . 2014-05-08 05:52	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-07 19:26 . 2014-04-03 07:51	63192	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-05-07 19:26 . 2014-04-03 07:51	88280	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-05-07 19:26 . 2014-04-03 07:50	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-05-07 19:26 . 2014-05-07 19:27	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 19:26 . 2014-05-07 19:26	--------	d-----w-	c:\programdata\Malwarebytes
2014-05-06 06:27 . 2014-04-17 03:31	10651704	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{46A03312-313E-445A-A187-68D843D5565F}\mpengine.dll
2014-05-03 01:00 . 2014-04-29 14:01	23547904	----a-w-	c:\windows\system32\mshtml.dll
2014-05-03 01:00 . 2014-04-29 13:40	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-05-03 01:00 . 2014-04-29 12:34	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-04-29 07:22 . 2014-04-29 07:22	--------	d-----w-	C:\SiLabs
2014-04-29 07:21 . 2014-04-30 16:15	--------	d-----w-	c:\users\42\.LOGOComfort7.0
2014-04-29 07:21 . 2014-04-29 07:21	--------	d--h--w-	c:\program files\Zero G Registry
2014-04-29 07:21 . 2014-04-29 07:21	--------	d-----w-	c:\program files\Siemens
2014-04-29 07:21 . 2014-04-29 07:21	--------	d--h--w-	c:\users\42\InstallAnywhere
2014-04-29 07:21 . 2014-04-29 07:21	--------	d-----w-	C:\tmp
2014-04-27 13:53 . 2012-05-30 11:42	569152	----a-w-	c:\windows\system32\drivers\iaStor.sys
2014-04-21 10:38 . 2014-04-21 10:38	--------	d-----w-	c:\program files (x86)\Lenovo Battery Utility 2014
2014-04-15 14:42 . 2014-04-15 14:43	--------	d-----w-	c:\program files (x86)\WinMerge
2014-04-10 08:58 . 2014-03-06 09:31	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-04-09 07:03 . 2014-03-04 09:44	243712	----a-w-	c:\windows\system32\wow64.dll
2014-04-09 07:03 . 2014-03-04 09:44	1163264	----a-w-	c:\windows\system32\kernel32.dll
2014-04-09 07:02 . 2014-03-04 09:44	362496	----a-w-	c:\windows\system32\wow64win.dll
2014-04-09 07:02 . 2014-03-04 09:16	25600	----a-w-	c:\windows\SysWow64\setup16.exe
2014-04-09 07:02 . 2014-03-04 09:44	13312	----a-w-	c:\windows\system32\wow64cpu.dll
2014-04-09 07:02 . 2014-03-04 09:44	16384	----a-w-	c:\windows\system32\ntvdm64.dll
2014-04-09 07:02 . 2014-03-04 09:17	14336	----a-w-	c:\windows\SysWow64\ntvdm64.dll
2014-04-09 07:02 . 2014-03-04 09:16	5120	----a-w-	c:\windows\SysWow64\wow32.dll
2014-04-09 07:02 . 2014-03-04 08:09	7680	----a-w-	c:\windows\SysWow64\instnm.exe
2014-04-09 07:02 . 2014-03-04 08:09	2048	----a-w-	c:\windows\SysWow64\user.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-10 01:01 . 2014-01-24 14:37	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-03-07 18:26 . 2014-03-07 18:26	81920	----a-r-	c:\users\42\AppData\Roaming\Microsoft\Installer\{FE2A7490-32EA-47D1-BCB4-0705F73F4C24}\_12CBB74432AE_4FAC_A7BC_14379DE05095.exe
2014-03-04 09:17 . 2014-04-09 07:02	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-02-11 08:10 . 2014-02-11 08:10	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-08 08:40 . 2014-01-24 15:13	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-08 08:40 . 2014-01-24 15:13	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\42\AppData\Local\Akamai\netsession_win.exe" [2014-04-17 4672920]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2013-02-05 1081224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"="c:\program files (x86)\ThinkPad\Utilities\PWMTR64V.DLL" [2013-12-09 6623576]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-01-17 113656]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"Sophos AutoUpdate Monitor"="c:\program files (x86)\Sophos\AutoUpdate\almon.exe" [2013-01-11 929272]
"FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2010-11-19 37888]
"ADSK DLMSession"="c:\program files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe" [2013-02-01 1641368]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"S7UB Start"="c:\program files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe" [2010-06-03 102453]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2013-02-05 1081224]
.
c:\users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
GameRanger.lnk - c:\users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe /autostart [2009-7-1 1824928]
miranda32.exe - Verknüpfung.lnk - c:\program files (x86)\Miranda IM\miranda32.exe [2014-1-16 829524]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Start 3DxWare.lnk - c:\program files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe [2014-1-24 135680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll c:\progra~2\Sophos\SOPHOS~1\sophos_detoured.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001
.
3;4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
3;4 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 swi_update_64;Sophos Web Intelligence Update;c:\programdata\Sophos\Web Intelligence\swi_update_64.exe;c:\programdata\Sophos\Web Intelligence\swi_update_64.exe [x]
R3 AMPPALP;Intel(r) Centrino(r) Wireless Bluetooth(r) + High Speed Protokoll;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
R3 sdcfilter;sdcfilter;c:\windows\system32\DRIVERS\sdcfilter.sys;c:\windows\SYSNATIVE\DRIVERS\sdcfilter.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys;c:\windows\SYSNATIVE\DRIVERS\SophosBootDriver.sys [x]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys;c:\windows\SYSNATIVE\DRIVERS\smiifx64.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys;c:\windows\SYSNATIVE\DRIVERS\savonaccess.sys [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 almservice;Automation License Manager Service;c:\program files\Common Files\Siemens\sws\almsrv\almsrv64x.exe;c:\program files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 hasplms;Sentinel LDK License Manager;c:\windows\system32\hasplms.exe  -run;c:\windows\SYSNATIVE\hasplms.exe  -run [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 mitsijm2014;Autodesk Simulation Moldflow MITSI 2014 Job-Manager;c:\program files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe;c:\program files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [x]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x]
S2 s7hspsvx;S7 HSP Service;c:\program files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe;c:\program files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [x]
S2 s7oiehsx64;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [x]
S2 s7ousbu64x;SIMATIC USB Service;c:\windows\system32\DRIVERS\s7ousbu64x.sys;c:\windows\SYSNATIVE\DRIVERS\s7ousbu64x.sys [x]
S2 s7sn2srtx;PROFINET IO RT-Protocol V2.0;c:\windows\system32\DRIVERS\s7sn2srtx.sys;c:\windows\SYSNATIVE\DRIVERS\s7sn2srtx.sys [x]
S2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [x]
S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe;c:\windows\SYSNATIVE\SAsrv.exe [x]
S2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [x]
S2 SAVService;Sophos Anti-Virus;c:\program files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [x]
S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
S2 Sophos Web Control Service;Sophos Web Control Service;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 swi_service;Sophos Web Intelligence Service;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x]
S3 AMPPAL;Intel(r) Centrino(r) Wireless Bluetooth(r) + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 dpmconv;SIMATIC NET DP Driver;c:\windows\system32\DRIVERS\dpmconv.sys;c:\windows\SYSNATIVE\DRIVERS\dpmconv.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys;c:\windows\SYSNATIVE\DRIVERS\FLxHCIc.sys [x]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys;c:\windows\SYSNATIVE\DRIVERS\FLxHCIh.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 Power Manager DBC Service;Power Manager Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
S3 s7odpx2x64;SIMATIC Knotentaufe;c:\windows\system32\DRIVERS\s7odpx2x64.sys;c:\windows\SYSNATIVE\DRIVERS\s7odpx2x64.sys [x]
S3 s7oppinx64;SIMATIC PPI Transport;c:\windows\system32\DRIVERS\s7oppinx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7oppinx64.sys [x]
S3 s7oserix64;Siemens PC Serial Cable;c:\windows\system32\Drivers\s7oserix64.sys;c:\windows\SYSNATIVE\Drivers\s7oserix64.sys [x]
S3 s7osmcax64;SIMATIC PC Adapter RS232;c:\windows\system32\DRIVERS\s7osmcax64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osmcax64.sys [x]
S3 s7osobux64;SIMATIC SoftBus;c:\windows\system32\DRIVERS\s7osobux64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osobux64.sys [x]
S3 s7otmcd64x;SIMATIC Memory Cards;c:\windows\system32\Drivers\s7otmcd64x.sys;c:\windows\SYSNATIVE\Drivers\s7otmcd64x.sys [x]
S3 s7otranx64;SIMATIC Transport;c:\windows\system32\DRIVERS\s7otranx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otranx64.sys [x]
S3 s7otsadx64;SIMATIC TS Adapter RS232;c:\windows\system32\DRIVERS\s7otsadx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otsadx64.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
S3 vsnl2ada;SIMATIC NET FDL Driver;c:\windows\system32\DRIVERS\vsnl2ada.sys;c:\windows\SYSNATIVE\DRIVERS\vsnl2ada.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - uwlyipog
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-08 c:\windows\Tasks\MATLAB R2013a Startup Accelerator.job
- c:\program files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe [2014-01-24 16:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-14 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-14 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-14 416024]
"TpShocks"="TpShocks.exe" [2013-11-29 384344]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll c:\progra~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: {{605E5D27-BFA0-471F-87ED-98A2623D633C} - c:\program files (x86)\CADE Pro 2.20.3\Web\new.htm
LSP: c:\programdata\Sophos\Web Intelligence\swi_ifslsp.dll
TCP: DhcpNameServer = 192.168.1.1 83.169.186.225 83.169.186.161
TCP: Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: NameServer = 192.168.0.1
FF - ProfilePath - c:\users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-DudeServer - c:\program files (x86)\Dude\dude.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-08  08:24:32
ComboFix-quarantined-files.txt  2014-05-08 06:24
.
Vor Suchlauf: 15 Verzeichnis(se), 116.267.761.664 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 118.381.768.704 Bytes frei
.
- - End Of File - - 4790266F7DA796A1AAFF3AE20994D91D
         

Ergänzung 21Uhr

Hatte eben eine meldung von Sophos das ein Thread Erkannt worden währe (Adware/PUA NimCmd), habe jetzt Sophos, Malwarebytes Anti-Malware , FRST und GMER nochmal durchlaufen lassen.

Sophos kann leider momentan nicht Aktualisiert werden weil meine Zugangsdaten auf den Server nicht gültig sind...

20140501 073054	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140501 073055	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468112 Objekte erkennen.
20140501 073055	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140501 083048	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140501 083049	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468121 Objekte erkennen.
20140501 083049	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140501 131924	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468121 Objekte erkennen.
20140501 131924	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20140501 142446	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140501 142448	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468129 Objekte erkennen.
20140501 142448	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140501 160542	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140501 160546	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468138 Objekte erkennen.
20140501 160546	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140502 055116	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140502 055120	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468149 Objekte erkennen.
20140502 055121	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140502 065108	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140502 065111	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468153 Objekte erkennen.
20140502 065111	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140502 112021	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140502 112025	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468161 Objekte erkennen.
20140502 112025	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140503 010052	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140503 010053	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468191 Objekte erkennen.
20140503 010053	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140503 072336	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140503 072337	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468203 Objekte erkennen.
20140503 072337	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140503 102329	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140503 102330	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468207 Objekte erkennen.
20140503 102330	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140503 182331	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140503 182332	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468209 Objekte erkennen.
20140503 182332	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140503 222401	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140503 222405	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468210 Objekte erkennen.
20140503 222406	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140504 054005	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140504 054011	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468217 Objekte erkennen.
20140504 054011	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140504 063943	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140504 063946	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468222 Objekte erkennen.
20140504 063947	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140504 103914	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140504 103915	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468225 Objekte erkennen.
20140504 103915	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140504 183912	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140504 183913	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468229 Objekte erkennen.
20140504 183913	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140505 070249	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140505 070250	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468246 Objekte erkennen.
20140505 070250	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140505 100248	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140505 100249	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468252 Objekte erkennen.
20140505 100249	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140505 120248	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140505 120249	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468265 Objekte erkennen.
20140505 120249	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140505 214657	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140505 214659	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468294 Objekte erkennen.
20140505 214659	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140506 091601	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140506 091603	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468321 Objekte erkennen.
20140506 091603	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140506 101601	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140506 101602	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468326 Objekte erkennen.
20140506 101602	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20140507 194527	Datei "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" gehört zu Adware/PUA 'Somoto BetterInstaller' (Typ Andere).
20140507 194527	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" für folgenden Benutzer verweigert: Thinkpad\42
20140507 194527	Datei "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" gehört zu Adware/PUA 'Somoto BetterInstaller' (Typ Andere).
20140507 194527	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" für folgenden Benutzer verweigert: Thinkpad\42
20140507 194531	Datei "C:\Users\42\AppData\Local\Temp\UPDATECHECKERSETUP.EXE" gehört zu Adware/PUA 'Somoto BetterInstaller' (Typ Andere).
20140507 194531	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Users\42\AppData\Local\Temp\UPDATECHECKERSETUP.EXE" für folgenden Benutzer verweigert: Thinkpad\42
20140507 194531	Datei "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" gehört zu Adware/PUA 'Somoto BetterInstaller' (Typ Andere).
20140507 194531	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe" für folgenden Benutzer verweigert: Thinkpad\42
20140507 194628	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140507 195316	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468326 Objekte erkennen.
20140507 195316	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140507 201533	Scan 'Computer scannen' gestartet.
20140507 205159	Scan 'Computer scannen' abgeschlossen.
20140507 205159	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 733046
		Fehler: 0
		Objekte in Quarantäne: 0
		Behandelte Objekte: 0
20140507 213001	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468326 Objekte erkennen.
20140507 213002	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140507 214458	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer gestartet.
20140507 214917	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468326 Objekte erkennen.
20140507 214917	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20140507 214934	Der Scan von 'Boot Record, Laufwerk E:' führte zu SAV Interface-Fehler 0xa0040210: Kein Zugriff auf Datei.
20140507 215849	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140507 220640	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer gestartet.
20140508 055824	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer abgebrochen.
20140508 055949	Bei der Überprüfung des Verhaltens des Prozesses "C:\ComboFix\swreg.3XE" wurde ein Fehler erkannt.
20140508 060122	Bei der Überprüfung des Verhaltens des Prozesses "C:\ComboFix\swreg.3XE" wurde ein Fehler erkannt.
20140508 062237	Bei der Überprüfung des Verhaltens des Prozesses "C:\ComboFix\swreg.3XE" wurde ein Fehler erkannt.
20140508 062548	Benutzer (Thinkpad\42) hat den On-Access-Scan auf diesem Computer gestartet.
20140508 141150	Die Erkennungsdatenversion 4.98G (Detection Engine 3.50.1) wird verwendet. Diese Version kann 6468326 Objekte erkennen.
20140508 141151	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20140508 174337	Datei "C:\Windows\NIRCMD.exe" gehört zu Adware/PUA 'NirCmd' (Typ Andere).
20140508 174337	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Windows\NIRCMD.exe" für folgenden Benutzer verweigert: NT-AUTORITÄT\SYSTEM
20140508 175221	Scan 'Computer scannen' gestartet.
20140508 175622	Datei "C:\Windows\NIRCMD.exe" gehört zu Adware/PUA 'NirCmd' (Typ Andere).
20140508 182744	Adware/PUA 'NirCmd' wurde erkannt.
20140508 182744	Scan 'Computer scannen' abgeschlossen.
20140508 182744	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 779929
		Fehler: 0
		Objekte in Quarantäne: 1
		Behandelte Objekte: 0
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 08.05.2014
Scan Time: 20:37:59
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.05.08.08
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: 42

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 316999
Time Elapsed: 5 min, 10 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-05-2014
Ran by 42 (administrator) on THINKPAD on 08-05-2014 20:39:35
Running from C:\Users\42\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrvlauncher.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]

==================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-08] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 07:59 - 2014-05-08 08:25 - 00000000 ____D () C:\Qoobox
2014-05-08 07:59 - 2014-05-08 08:21 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 07:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-08 07:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-08 07:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:06 - 2014-05-08 00:07 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-07 23:47 - 2014-05-08 00:06 - 00025387 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-08 20:39 - 00020769 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 23:30 - 2014-05-07 22:01 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-08 20:38 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-08 20:39 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-08 20:32 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-08 20:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-11 14:21 - 2014-04-08 11:31 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-11 14:21 - 2014-04-07 21:14 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
2014-04-11 14:21 - 2014-04-02 14:37 - 00018778 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0.ods
2014-04-10 10:59 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 10:59 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 10:59 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 10:59 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 10:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 10:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 10:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 10:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 10:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 10:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 10:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 10:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 10:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 10:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 09:02 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 09:02 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 09:02 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 09:02 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

==================== One Month Modified Files and Folders =======

2014-05-08 20:39 - 2014-05-07 23:30 - 00020769 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-08 20:39 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-08 20:38 - 2014-05-07 22:14 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-08 20:32 - 2014-05-07 22:03 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-08 20:25 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-08 18:17 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-08 18:17 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-08 18:17 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-08 16:19 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-08 16:19 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-08 16:14 - 2014-01-24 14:45 - 01644048 _____ () C:\Windows\WindowsUpdate.log
2014-05-08 16:12 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-08 16:11 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-08 16:11 - 2010-11-21 05:47 - 00027094 _____ () C:\Windows\PFRO.log
2014-05-08 16:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-08 16:11 - 2009-07-14 06:51 - 00066901 _____ () C:\Windows\setupact.log
2014-05-08 08:25 - 2014-05-08 07:59 - 00000000 ____D () C:\Qoobox
2014-05-08 08:25 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 08:21 - 2014-05-08 07:59 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 08:12 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:07 - 2014-05-08 00:06 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-08 00:06 - 2014-05-07 23:47 - 00025387 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:01 - 2014-05-07 23:30 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-21 11:29 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-04-17 23:16 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-10 18:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 03:02 - 2014-01-24 16:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:01 - 2014-01-24 16:37 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 01:10 - 2014-01-24 14:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 11:31 - 2014-04-11 14:21 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 08:59

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-08 20:57:13
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Samsung_ rev.EXT0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\42\AppData\Local\Temp\uwlyipog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                           fffff80002dee000 45 bytes [00, 00, 11, 00, 4D, 6D, 43, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                           fffff80002dee02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[1020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[1020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Windows\system32\hasplms.exe[2892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000076471465 2 bytes [47, 76]
.text     C:\Windows\system32\hasplms.exe[2892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Windows\SysWOW64\SAsrv.exe[3208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  0000000076471465 2 bytes [47, 76]
.text     C:\Windows\SysWOW64\SAsrv.exe[3208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[3456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[3456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000076471465 2 bytes [47, 76]
.text     C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000076471465 2 bytes [47, 76]
.text     C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
?         C:\Windows\system32\mssprxy.dll [3372] entry point in ".rdata" section                                                                                       00000000719371e6
.text     C:\Users\42\AppData\Local\Akamai\netsession_win.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000076471465 2 bytes [47, 76]
.text     C:\Users\42\AppData\Local\Akamai\netsession_win.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Users\42\AppData\Local\Akamai\netsession_win.exe[5400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000076471465 2 bytes [47, 76]
.text     C:\Users\42\AppData\Local\Akamai\netsession_win.exe[5400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Miranda IM\miranda32.exe[4120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Miranda IM\miranda32.exe[4120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher                                                               0000000076f10124 5 bytes JMP 00000001746b8620
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                              0000000076f3c4dd 5 bytes JMP 00000001746b4e10
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread                                                                       0000000076f5801c 5 bytes JMP 00000001746b4ff0
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!WriteFile                                                                            00000000749a1282 5 bytes JMP 00000001746b4e70
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!FreeLibrary                                                                          00000000749a3488 5 bytes JMP 00000001746b5240
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!VirtualProtect                                                                       00000000749a4327 5 bytes JMP 00000001746b4ed0
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA                                                                       00000000749a48db 5 bytes JMP 00000001746b4f50
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!LoadLibraryW                                                                         00000000749a48f3 5 bytes JMP 00000001746b4f10
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW                                                                       00000000749a4925 5 bytes JMP 00000001746b4f30
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                         00000000749a499f 5 bytes JMP 00000001746b4f70
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!CreateFileA                                                                          00000000749a538e 5 bytes JMP 00000001746b5070
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!GlobalAlloc                                                                          00000000749a5856 5 bytes JMP 00000001746b4f90
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                                          00000000749a79d8 5 bytes JMP 00000001746b5010
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA                                                               00000000749ba48f 5 bytes JMP 00000001746b5030
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory                                                                   00000000749bd9b0 5 bytes JMP 00000001746b4e30
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!GetThreadContext                                                                     00000000749c799c 5 bytes JMP 00000001746b4fb0
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx                                                                     0000000074a24aff 5 bytes JMP 00000001746b4eb0
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!WriteFileEx                                                                          0000000074a24b2f 5 bytes JMP 00000001746b4e50
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\kernel32.dll!SetThreadContext                                                                     0000000074a258d3 5 bytes JMP 00000001746b4ef0
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000076471465 2 bytes [47, 76]
.text     C:\Windows\SysWOW64\rundll32.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[6104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[6104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[5388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                            0000000076471465 2 bytes [47, 76]
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[5388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                           00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                          0000000076471465 2 bytes [47, 76]
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                         00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[7032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[7032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7900] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7900] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                         0000000076471465 2 bytes [47, 76]
.text     C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                        00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Windows\SysWOW64\pniopcac.exe[8120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000076471465 2 bytes [47, 76]
.text     C:\Windows\SysWOW64\pniopcac.exe[8120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2
.text     C:\Users\42\Desktop\Gmer-19357.exe[6508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                             0000000076471465 2 bytes [47, 76]
.text     C:\Users\42\Desktop\Gmer-19357.exe[6508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                            00000000764714bb 2 bytes [47, 76]
.text     ...                                                                                                                                                          * 2

---- EOF - GMER 2.1 ----
         

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

# AdwCleaner v3.207 - Bericht erstellt am 09/05/2014 um 18:04:09
# Aktualisiert 05/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : 42 - THINKPAD
# Gestartet von : C:\Users\42\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\prefs.js ]


*************************

AdwCleaner[R0].txt - [894 octets] - [09/05/2014 17:55:41]
AdwCleaner[R1].txt - [953 octets] - [09/05/2014 17:57:38]
AdwCleaner[R2].txt - [1012 octets] - [09/05/2014 18:03:32]
AdwCleaner[S0].txt - [889 octets] - [09/05/2014 18:04:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [948 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by 42 on 09.05.2014 at 18:05:44,67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.05.2014 at 18:14:36,37
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2014 01
Ran by 42 (administrator) on THINKPAD on 09-05-2014 18:16:47
Running from C:\Users\42\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]

==================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-09] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-09 18:16 - 2014-05-09 18:16 - 00000000 ____D () C:\Users\42\Desktop\FRST-OlderVersion
2014-05-09 18:14 - 2014-05-09 18:14 - 00000622 _____ () C:\Users\42\Desktop\JRT.txt
2014-05-09 17:23 - 2014-05-09 18:04 - 00000000 ____D () C:\AdwCleaner
2014-05-09 17:23 - 2014-05-09 17:23 - 00000000 ____D () C:\Windows\ERUNT
2014-05-09 17:22 - 2014-05-09 17:22 - 01316991 _____ () C:\Users\42\Desktop\adwcleaner.exe
2014-05-09 17:22 - 2014-05-09 17:21 - 01016261 _____ (Thisisu) C:\Users\42\Desktop\JRT.exe
2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 07:59 - 2014-05-08 08:25 - 00000000 ____D () C:\Qoobox
2014-05-08 07:59 - 2014-05-08 08:21 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 07:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-08 07:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-08 07:59 - 2009-04-20 06:56 - 00060416 _____ () C:\Windows\NIRCMD.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:06 - 2014-05-08 00:07 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-07 23:47 - 2014-05-08 20:57 - 00022955 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-09 18:16 - 02064384 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 23:30 - 2014-05-09 18:16 - 00020214 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-08 20:38 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-09 18:16 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-08 20:32 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-09 18:05 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-11 14:21 - 2014-04-08 11:31 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-11 14:21 - 2014-04-07 21:14 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
2014-04-11 14:21 - 2014-04-02 14:37 - 00018778 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0.ods
2014-04-10 10:59 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 10:59 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 10:59 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 10:59 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 10:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 10:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 10:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 10:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 10:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 10:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 10:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 10:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 10:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 10:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 09:02 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 09:02 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 09:02 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 09:02 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

==================== One Month Modified Files and Folders =======

2014-05-09 18:16 - 2014-05-09 18:16 - 00000000 ____D () C:\Users\42\Desktop\FRST-OlderVersion
2014-05-09 18:16 - 2014-05-07 23:30 - 02064384 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-09 18:16 - 2014-05-07 23:30 - 00020214 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-09 18:16 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-09 18:14 - 2014-05-09 18:14 - 00000622 _____ () C:\Users\42\Desktop\JRT.txt
2014-05-09 18:12 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-09 18:12 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-09 18:09 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-09 18:09 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-09 18:09 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-09 18:05 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-09 18:05 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-09 18:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-09 18:04 - 2014-05-09 17:23 - 00000000 ____D () C:\AdwCleaner
2014-05-09 18:04 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-09 18:04 - 2014-01-24 14:45 - 01711732 _____ () C:\Windows\WindowsUpdate.log
2014-05-09 18:04 - 2010-11-21 05:47 - 00027400 _____ () C:\Windows\PFRO.log
2014-05-09 18:04 - 2009-07-14 06:51 - 00066957 _____ () C:\Windows\setupact.log
2014-05-09 17:23 - 2014-05-09 17:23 - 00000000 ____D () C:\Windows\ERUNT
2014-05-09 17:22 - 2014-05-09 17:22 - 01316991 _____ () C:\Users\42\Desktop\adwcleaner.exe
2014-05-09 17:21 - 2014-05-09 17:22 - 01016261 _____ (Thisisu) C:\Users\42\Desktop\JRT.exe
2014-05-08 20:57 - 2014-05-07 23:47 - 00022955 _____ () C:\Users\42\Desktop\GMER.log
2014-05-08 20:38 - 2014-05-07 22:14 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-08 20:32 - 2014-05-07 22:03 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-08 08:25 - 2014-05-08 07:59 - 00000000 ____D () C:\Qoobox
2014-05-08 08:25 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 08:21 - 2014-05-08 07:59 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 08:12 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:07 - 2014-05-08 00:06 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-21 11:29 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-04-17 23:16 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-10 18:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 03:02 - 2014-01-24 16:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:01 - 2014-01-24 16:37 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 01:10 - 2014-01-24 14:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\42\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 17:16

==================== End Of Log ============================
         

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Beim ESET Scanner kommt eine Fehlermeldung.

"Updates funktionieren nicht. Ist ein Proxy eingerichtet?"

Habe aber definitiv nie einen eingerichtet ^^

Eben noch mal geprüft (Start->inetcpl.cpl->Verbindungen->LAN-Einstellungen) da ist keiner drinne.

Alternativen oder ideen?

ESET weg lassen, dafür nen Vollscan mit deinem Antivirenprogramm machen.

Sophos und Malwarebytes Anti-Malware haben beide nichts gefunden.

 Results of screen317's Security Check version 0.99.82  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Sophos Anti-Virus   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 51  
 Java version out of Date! 
  Adobe Flash Player 12.0.0.44 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox (28.0) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Sophos Sophos Anti-Virus SavService.exe  
 Sophos Sophos Anti-Virus SAVAdminService.exe  
 Sophos Sophos Anti-Virus Web Control swc_service.exe 
 Sophos Sophos Anti-Virus Web Intelligence swi_service.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-05-2014
Ran by 42 (administrator) on THINKPAD on 14-05-2014 22:33:07
Running from C:\Users\42\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrvlauncher.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Acresso Corporation) C:\Config.Msi\e6da251.rbf
(Microsoft Corporation) C:\Windows\System32\prevhost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Flexera Software) C:\Program Files\Siemens\LOGOComfort_V7(Demo)\Start.exe
(Sun Microsystems, Inc.) C:\Program Files\Siemens\LOGOComfort_V7(Demo)\jre\bin\javaw.exe
(The MathWorks Inc.) C:\Program Files\MATLAB\R2013a\bin\win64\MATLAB.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMUI.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(TeX Users Group) C:\Program Files (x86)\Neuer Ordner\miktex\bin\miktex-texworks.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Ing.-Büro Dr. Kahlert) C:\Program Files (x86)\Kahlert\WinFACT 7\Ingo.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Ingenieurbüro Dr. Kahlert) C:\Program Files (x86)\Kahlert\WinFACT 7\Boris.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_12_0_0_44_Plugin.exe [840584 2014-02-08] (Adobe Systems Incorporated)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]

==================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-14] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-14 22:25 - 2014-05-14 22:25 - 00855379 _____ () C:\Users\42\Desktop\SecurityCheck.exe
2014-05-12 19:13 - 2014-05-05 10:11 - 00020897 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0_1.ods
2014-05-12 16:32 - 2014-05-12 16:32 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-10 20:22 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\42\AppData\Roaming\FLEXnet
2014-05-10 20:17 - 2014-05-10 20:17 - 00000000 __SHD () C:\Users\42\AppData\Local\EmieUserList
2014-05-10 20:17 - 2014-05-10 20:17 - 00000000 __SHD () C:\Users\42\AppData\Local\EmieSiteList
2014-05-10 20:15 - 2014-05-10 20:15 - 00000000 ____D () C:\Users\42\AppData\Roaming\Vodafone
2014-05-10 20:13 - 2014-05-10 20:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_ecm_enum_01009.Wdf
2014-05-10 20:13 - 2014-05-10 20:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_cdc_ecm_01009.Wdf
2014-05-10 20:12 - 2014-05-10 20:12 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_cdc_acm_01009.Wdf
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____D () C:\Users\42\AppData\Local\{EBB94E3B-3BF9-4353-8238-02E9637A682C}
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____D () C:\ProgramData\Vodafone
2014-05-10 15:25 - 2014-05-10 15:25 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-09 18:16 - 2014-05-14 22:32 - 00000000 ____D () C:\Users\42\Desktop\FRST-OlderVersion
2014-05-09 18:14 - 2014-05-09 18:14 - 00000622 _____ () C:\Users\42\Desktop\JRT.txt
2014-05-09 17:23 - 2014-05-09 18:04 - 00000000 ____D () C:\AdwCleaner
2014-05-09 17:23 - 2014-05-09 17:23 - 00000000 ____D () C:\Windows\ERUNT
2014-05-09 17:22 - 2014-05-09 17:22 - 01316991 _____ () C:\Users\42\Desktop\adwcleaner.exe
2014-05-09 17:22 - 2014-05-09 17:21 - 01016261 _____ (Thisisu) C:\Users\42\Desktop\JRT.exe
2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 07:59 - 2014-05-08 08:25 - 00000000 ____D () C:\Qoobox
2014-05-08 07:59 - 2014-05-08 08:21 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 07:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-08 07:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-08 07:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:06 - 2014-05-08 00:07 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-07 23:47 - 2014-05-08 20:57 - 00022955 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-14 22:33 - 00022102 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-14 22:32 - 02066944 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-08 20:38 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-14 22:33 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-08 20:32 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-14 20:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge

==================== One Month Modified Files and Folders =======

2014-05-14 22:33 - 2014-05-07 23:30 - 00022102 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-14 22:33 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-14 22:32 - 2014-05-09 18:16 - 00000000 ____D () C:\Users\42\Desktop\FRST-OlderVersion
2014-05-14 22:32 - 2014-05-07 23:30 - 02066944 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-14 22:25 - 2014-05-14 22:25 - 00855379 _____ () C:\Users\42\Desktop\SecurityCheck.exe
2014-05-14 21:51 - 2014-03-07 20:27 - 00000233 _____ () C:\Windows\FTRUN32.INI
2014-05-14 21:41 - 2014-01-24 14:45 - 01976854 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 20:40 - 2009-07-14 06:51 - 00072609 _____ () C:\Windows\setupact.log
2014-05-14 20:08 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-14 18:09 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-14 18:09 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-14 18:09 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-14 14:14 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-14 11:33 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-13 16:02 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-05-12 17:29 - 2014-01-24 14:48 - 00113568 _____ () C:\Users\42\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-12 16:32 - 2014-05-12 16:32 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-05-10 20:22 - 2014-05-10 20:22 - 00000000 ____D () C:\Users\42\AppData\Roaming\FLEXnet
2014-05-10 20:17 - 2014-05-10 20:17 - 00000000 __SHD () C:\Users\42\AppData\Local\EmieUserList
2014-05-10 20:17 - 2014-05-10 20:17 - 00000000 __SHD () C:\Users\42\AppData\Local\EmieSiteList
2014-05-10 20:15 - 2014-05-10 20:15 - 00000000 ____D () C:\Users\42\AppData\Roaming\Vodafone
2014-05-10 20:13 - 2014-05-10 20:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_ecm_enum_01009.Wdf
2014-05-10 20:13 - 2014-05-10 20:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_cdc_ecm_01009.Wdf
2014-05-10 20:12 - 2014-05-10 20:12 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_zte_cdc_acm_01009.Wdf
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____D () C:\Users\42\AppData\Local\{EBB94E3B-3BF9-4353-8238-02E9637A682C}
2014-05-10 20:11 - 2014-05-10 20:11 - 00000000 ____D () C:\ProgramData\Vodafone
2014-05-10 20:11 - 2014-01-24 23:47 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-05-10 15:25 - 2014-05-10 15:25 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-09 21:23 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-09 21:23 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-09 21:16 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-09 21:16 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-09 18:14 - 2014-05-09 18:14 - 00000622 _____ () C:\Users\42\Desktop\JRT.txt
2014-05-09 18:04 - 2014-05-09 17:23 - 00000000 ____D () C:\AdwCleaner
2014-05-09 18:04 - 2010-11-21 05:47 - 00027400 _____ () C:\Windows\PFRO.log
2014-05-09 17:23 - 2014-05-09 17:23 - 00000000 ____D () C:\Windows\ERUNT
2014-05-09 17:22 - 2014-05-09 17:22 - 01316991 _____ () C:\Users\42\Desktop\adwcleaner.exe
2014-05-09 17:21 - 2014-05-09 17:22 - 01016261 _____ (Thisisu) C:\Users\42\Desktop\JRT.exe
2014-05-08 20:57 - 2014-05-07 23:47 - 00022955 _____ () C:\Users\42\Desktop\GMER.log
2014-05-08 20:38 - 2014-05-07 22:14 - 00001051 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-08 20:32 - 2014-05-07 22:03 - 00038990 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-08 08:25 - 2014-05-08 07:59 - 00000000 ____D () C:\Qoobox
2014-05-08 08:25 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-05-08 08:24 - 2014-05-08 08:24 - 00021176 _____ () C:\ComboFix.txt
2014-05-08 08:21 - 2014-05-08 07:59 - 00000000 ____D () C:\Windows\erdnt
2014-05-08 08:12 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-08 07:57 - 2014-05-08 07:57 - 05200039 ____R (Swearware) C:\Users\42\Desktop\ComboFix.exe
2014-05-08 00:07 - 2014-05-08 00:06 - 00107506 _____ () C:\Users\42\Desktop\TB.txt
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-05 10:11 - 2014-05-12 19:13 - 00020897 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0_1.ods
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge

Some content of TEMP:
====================
C:\Users\42\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 17:16

==================== End Of Log ============================
         

--- --- ---

Java und Flash updaten.


Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.