Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Emailaccount sendet Spam an Adressen aus der Kontaktliste

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 02.06.2014, 23:21   #1
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Hallo,
seit 2 Tagen sendet einer meiner yahoo-emailaccounts Spammails an meine Kontaktliste. Ich hab bereits zweimal das Passwort geändert, aber zumindest nach dem ersten Mal sind neue Spammails aufgetaucht. Die Mails variieren. Einige sind (angeblich) direkt von meinem Account, einige haben als Betreff meinen Account und einige wiederum sind von einem gleichnamigen Account, aber mit ".com" als Endung statt ".de". Als Antivirenprogramm verwende ich Antivir, als Browser Firefox und mein Mailprogramm ist Mozilla Thunderbird. Ich bin grad echt verunsichert und es hagelt von allen Seiten Beschwerden wegen der Mails.
Hier sind die Logfiles, um die ihr bittet. Ich hoffe, das sind alle.
Vielen Dank schonmal für eure Hilfe!

Sven

FRST
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Sven (administrator) on KLAGGES on 02-06-2014 23:45:17
Running from C:\Users\Sven\Desktop
Platform: Windows 8.1 Pro (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\SystemAgent\SystemAgentService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(LENOVO INCORPORATED.) C:\Program Files\Lenovo\QuickSnipService\QuickSnipService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Lenovo) C:\Program Files\Lenovo\QuickSnipService\QuickSnipInput.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
() C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\extapsup.exe
(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\NalService.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
() C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [147160 2013-07-10] (Realtek Semiconductor Corp.)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7830328 2013-05-21] (Motorola Solutions, Inc.)
HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [384296 2013-10-28] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll [74288 2014-03-04] (Lenovo Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [909016 2013-10-21] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoNal] => C:\Program Files\Lenovo\Lenovo Peer Connect\NalService.exe [19960 2013-10-18] (Lenovo)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2810608 2014-04-07] (Synaptics Incorporated)
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [750320 2014-01-28] (Lenovo)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1282787320-2724149473-996529921-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Sven\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1282787320-2724149473-996529921-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Akamai NetSession Interface] => C:\Users\Sven\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ThinkPad OneLink Dock Management.lnk
ShortcutTarget: ThinkPad OneLink Dock Management.lnk -> C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe ()
Startup: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
SearchScopes: HKLM - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB
SearchScopes: HKLM-x32 - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB
SearchScopes: HKCU - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default
FF Homepage: www.tagesschau.de
FF NetworkProxy: "ftp", "94.228.205.33"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "94.228.205.33"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "94.228.205.33"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "94.228.205.33"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Spiele\die sieder 7\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll (Ubisoft)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-15]
FF Extension: Stealthy - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\stealthyextension@gmail.com.xpi [2014-03-15]
FF Extension: NoScript - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-15]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [573488 2014-03-04] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)
R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [140016 2014-01-28] (Lenovo)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-08-29] (Intel Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [198120 2013-08-01] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 Lenovo QuickSnip Service; C:\Program Files\lenovo\QuickSnipService\QuickSnipService.exe [219976 2013-12-02] (LENOVO INCORPORATED.)
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2085184 2014-03-10] (Lenovo Group Limited)
R2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [585032 2013-12-02] (LENOVO INCORPORATED.)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [702512 2014-03-04] (Lenovo Corporation)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
S3 LenovoEMCDiscovery; C:\Program Files\LenovoEMC\StorageConnector\LenovoEMCDiscovery.exe [1410888 2014-04-08] (LenovoEMC Products USA, LLC)
R2 lnvDiscoveryWinSvc; C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [21496 2013-10-18] (Lenovo)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [468288 2013-12-11] ()
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1662424 2014-02-19] ()
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1844024 2013-12-18] (Maxthon)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-01-08] ()
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
S2 QuickControlMasterSvc; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [59440 2013-12-16] (Lenovo Group Limited)
R3 QuickControlService; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [319024 2013-12-16] (Lenovo Group Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2014-01-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [121616 2014-03-13] (BlueStack Systems)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1386296 2013-08-19] (Motorola Solutions, Inc.)
R0 Fastboot; C:\Windows\System32\DRIVERS\fastboot.sys [65928 2014-01-28] (Windows (R) Win 7 DDK provider)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [117192 2013-08-29] (Intel Corporation)
R3 INETMON; C:\WINDOWS\System32\Drivers\INETMON.sys [29088 2013-08-01] ()
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-01] ()
S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-10-07] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-02] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3610592 2014-01-28] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-02-22] (Microsoft Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [418008 2013-06-24] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8247512 2013-07-10] (Realtek Semiconductor Corp.)
R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)
R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-04-07] (Synaptics Incorporated)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 SWIX64; C:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys [33856 2012-09-12] (Lenovo Group Limited)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-02 23:45 - 2014-06-02 23:45 - 00000000 ____D () C:\Users\Sven\Desktop\FRST-OlderVersion
2014-06-02 23:43 - 2014-06-02 23:43 - 00050477 _____ () C:\Users\Sven\Desktop\Defogger.exe
2014-06-02 23:43 - 2014-06-02 23:43 - 00000470 _____ () C:\Users\Sven\Desktop\defogger_disable.log
2014-06-02 23:43 - 2014-06-02 23:43 - 00000000 _____ () C:\Users\Sven\defogger_reenable
2014-06-02 21:47 - 2014-06-02 21:47 - 00042192 _____ () C:\Users\Sven\Desktop\Addition.txt
2014-06-02 21:46 - 2014-06-02 23:45 - 00023244 _____ () C:\Users\Sven\Desktop\FRST.txt
2014-06-02 21:45 - 2014-06-02 23:45 - 00000000 ____D () C:\FRST
2014-06-02 19:24 - 2014-06-02 23:45 - 02068992 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe
2014-06-02 19:12 - 2014-06-02 19:13 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 19:10 - 2014-06-02 19:10 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 19:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-06-02 19:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-06-02 19:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-06-02 19:09 - 2014-06-02 19:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sven\Desktop\mbam-setup-2.0.2.1012.exe
2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-22 22:41 - 2014-05-22 22:43 - 69613920 _____ (CANON INC.) C:\Users\Sven\Desktop\dppw31415.exe
2014-05-22 22:29 - 2014-05-22 22:29 - 00000000 ____D () C:\Users\Public\Documents\Canon MyCameraFiles
2014-05-22 22:28 - 2014-05-22 22:28 - 00000000 ____D () C:\ProgramData\Canon_Inc_IC
2014-05-22 14:27 - 2014-05-22 14:27 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-05-22 12:02 - 2014-05-25 13:25 - 00005110 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges
2014-05-20 23:04 - 2014-05-20 23:04 - 00001350 _____ () C:\Users\Public\Desktop\PDF-Viewer.lnk
2014-05-20 23:04 - 2014-05-20 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
2014-05-20 23:00 - 2014-05-20 23:01 - 16587248 _____ (Tracker Software Products Ltd ) C:\Users\Sven\Desktop\PDFX142Vwer.exe
2014-05-19 21:25 - 2014-05-19 21:26 - 53746227 _____ () C:\Users\Sven\Desktop\Marteria - Welt der Wunder [Offizielles Video].wmv
2014-05-16 15:09 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt_map.dll
2014-05-16 15:09 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt100.dll
2014-05-16 15:09 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt_map.dll
2014-05-16 15:09 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt100.dll
2014-05-16 15:09 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2014-05-16 15:09 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2014-05-16 15:09 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2014-05-16 15:09 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wusa.exe
2014-05-16 15:09 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe
2014-05-15 20:54 - 2014-05-15 20:57 - 139096929 _____ () C:\Users\Sven\Desktop\7_Tage_.wmv
2014-05-15 19:07 - 2014-05-15 19:20 - 75553860 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.avi
2014-05-15 19:07 - 2014-05-15 19:12 - 236166224 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.mp4
2014-05-15 17:56 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2014-05-15 17:56 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-05-15 17:56 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2014-05-15 17:56 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-05-15 17:56 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2014-05-15 17:56 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2014-05-15 17:56 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2014-05-15 17:56 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-05-15 17:56 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-05-15 17:56 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-05-15 17:56 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 17:56 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-05-15 17:56 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 17:56 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-05-15 17:56 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-05-15 17:56 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-05-15 17:56 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-05-15 17:56 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2014-05-15 17:56 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-05-15 17:56 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-05-15 17:56 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-05-15 17:56 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-05-15 17:56 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-05-15 17:56 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2014-05-15 17:56 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-05-15 17:56 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2014-05-15 17:56 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-05-15 17:55 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-05-15 17:55 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-05-15 17:55 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-05-15 17:55 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-05-15 17:54 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-05-15 17:54 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Stoffkommode
2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Reli Examensarbeit Evolution und Schöpfung
2014-05-13 23:04 - 2014-05-15 21:04 - 00000000 ____D () C:\Users\Sven\Documents\Privates
2014-05-13 23:04 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Referendariat
2014-05-13 23:03 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Gemeinde & Co
2014-05-13 23:02 - 2014-05-13 23:03 - 00000000 ____D () C:\Users\Sven\Documents\E-Books
2014-05-13 23:01 - 2014-05-13 23:02 - 00000000 ____D () C:\Users\Sven\Documents\CD-DVD Images
2014-05-13 23:00 - 2014-05-13 23:01 - 00000000 ____D () C:\Users\Sven\Documents\Brennprojekte
2014-05-13 23:00 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Bewerbungen
2014-05-13 20:15 - 2014-05-13 20:27 - 377560045 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.wmv
2014-05-13 20:02 - 2014-05-13 20:14 - 370281562 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.avi
2014-05-13 18:30 - 2014-05-13 18:30 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-05-10 18:08 - 2014-05-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-02 23:45 - 2014-06-02 23:45 - 00000000 ____D () C:\Users\Sven\Desktop\FRST-OlderVersion
2014-06-02 23:45 - 2014-06-02 21:46 - 00023244 _____ () C:\Users\Sven\Desktop\FRST.txt
2014-06-02 23:45 - 2014-06-02 21:45 - 00000000 ____D () C:\FRST
2014-06-02 23:45 - 2014-06-02 19:24 - 02068992 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe
2014-06-02 23:45 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Local\Temp
2014-06-02 23:43 - 2014-06-02 23:43 - 00050477 _____ () C:\Users\Sven\Desktop\Defogger.exe
2014-06-02 23:43 - 2014-06-02 23:43 - 00000470 _____ () C:\Users\Sven\Desktop\defogger_disable.log
2014-06-02 23:43 - 2014-06-02 23:43 - 00000000 _____ () C:\Users\Sven\defogger_reenable
2014-06-02 23:43 - 2014-03-15 20:18 - 00000000 ____D () C:\Users\Sven
2014-06-02 23:35 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-06-02 21:47 - 2014-06-02 21:47 - 00042192 _____ () C:\Users\Sven\Desktop\Addition.txt
2014-06-02 19:45 - 2014-01-28 06:07 - 02091567 _____ () C:\WINDOWS\WindowsUpdate.log
2014-06-02 19:31 - 2014-03-15 20:24 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1282787320-2724149473-996529921-1001
2014-06-02 19:13 - 2014-06-02 19:12 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 19:10 - 2014-06-02 19:10 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-02 19:09 - 2014-06-02 19:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sven\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-02 17:48 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-06-02 16:50 - 2014-03-17 01:36 - 00000000 __RDO () C:\Users\Sven\SkyDrive
2014-06-02 16:50 - 2014-03-15 20:19 - 00000466 _____ () C:\Users\Sven\AppData\Local\RegisteredPackageInformation.xml
2014-06-02 08:01 - 2014-03-15 20:20 - 00152064 _____ () C:\WINDOWS\SysWOW64\Xui.trf
2014-06-02 08:01 - 2014-01-28 06:16 - 05795556 _____ () C:\Users\Public\CAFADEBUG.log
2014-06-02 07:54 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Roaming\Nitro PDF
2014-06-01 22:34 - 2013-08-22 16:46 - 00037621 _____ () C:\WINDOWS\setupact.log
2014-06-01 22:32 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-06-01 22:31 - 2013-10-07 20:23 - 02185102 _____ () C:\WINDOWS\PFRO.log
2014-05-31 14:05 - 2014-01-28 15:01 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-05-31 14:05 - 2014-01-28 15:01 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-05-31 14:05 - 2013-10-07 20:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-05-31 13:54 - 2014-03-27 21:38 - 00223232 ___SH () C:\Users\Sven\Desktop\Thumbs.db
2014-05-28 22:46 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-05-28 20:35 - 2014-03-18 15:46 - 00000000 ____D () C:\Users\Sven\AppData\Local\CrashDumps
2014-05-28 10:09 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Local\Packages
2014-05-27 23:58 - 2014-03-17 00:38 - 00000000 ____D () C:\Users\Sven\Documents\emails
2014-05-25 13:25 - 2014-05-22 12:02 - 00005110 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges
2014-05-25 11:15 - 2014-01-28 06:26 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo
2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-22 22:43 - 2014-05-22 22:41 - 69613920 _____ (CANON INC.) C:\Users\Sven\Desktop\dppw31415.exe
2014-05-22 22:29 - 2014-05-22 22:29 - 00000000 ____D () C:\Users\Public\Documents\Canon MyCameraFiles
2014-05-22 22:29 - 2014-04-12 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-22 22:29 - 2014-04-12 23:48 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-22 22:28 - 2014-05-22 22:28 - 00000000 ____D () C:\ProgramData\Canon_Inc_IC
2014-05-22 22:28 - 2014-04-12 23:50 - 00000000 ____D () C:\Users\Sven\AppData\Roaming\Canon
2014-05-22 14:27 - 2014-05-22 14:27 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-05-22 06:54 - 2014-03-19 19:10 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-22 06:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System
2014-05-22 06:54 - 2013-08-22 15:25 - 00000167 _____ () C:\WINDOWS\win.ini
2014-05-22 06:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-21 23:19 - 2014-03-22 19:26 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-05-21 23:18 - 2014-03-22 19:26 - 93223848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-05-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-05-21 06:09 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-20 23:04 - 2014-05-20 23:04 - 00001350 _____ () C:\Users\Public\Desktop\PDF-Viewer.lnk
2014-05-20 23:04 - 2014-05-20 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
2014-05-20 23:03 - 2014-03-16 22:00 - 00000000 ____D () C:\Program Files (x86)\Tools
2014-05-20 23:01 - 2014-05-20 23:00 - 16587248 _____ (Tracker Software Products Ltd ) C:\Users\Sven\Desktop\PDFX142Vwer.exe
2014-05-20 23:01 - 2014-03-23 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-05-19 21:26 - 2014-05-19 21:25 - 53746227 _____ () C:\Users\Sven\Desktop\Marteria - Welt der Wunder [Offizielles Video].wmv
2014-05-16 15:29 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-05-16 15:01 - 2014-03-15 20:19 - 00000000 ___RD () C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 15:01 - 2014-03-15 20:19 - 00000000 ___RD () C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 14:57 - 2014-03-15 20:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\SecureBootUpdates
2014-05-15 21:04 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Privates
2014-05-15 20:57 - 2014-05-15 20:54 - 139096929 _____ () C:\Users\Sven\Desktop\7_Tage_.wmv
2014-05-15 19:20 - 2014-05-15 19:07 - 75553860 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.avi
2014-05-15 19:12 - 2014-05-15 19:07 - 236166224 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.mp4
2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Stoffkommode
2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Reli Examensarbeit Evolution und Schöpfung
2014-05-13 23:06 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Referendariat
2014-05-13 23:04 - 2014-05-13 23:03 - 00000000 ____D () C:\Users\Sven\Documents\Gemeinde & Co
2014-05-13 23:03 - 2014-05-13 23:02 - 00000000 ____D () C:\Users\Sven\Documents\E-Books
2014-05-13 23:02 - 2014-05-13 23:01 - 00000000 ____D () C:\Users\Sven\Documents\CD-DVD Images
2014-05-13 23:01 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Brennprojekte
2014-05-13 23:00 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Bewerbungen
2014-05-13 20:27 - 2014-05-13 20:15 - 377560045 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.wmv
2014-05-13 20:14 - 2014-05-13 20:02 - 370281562 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.avi
2014-05-13 19:55 - 2014-01-28 06:15 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-13 18:30 - 2014-05-13 18:30 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-05-13 18:30 - 2014-04-16 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-13 18:30 - 2014-04-16 21:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-12 07:26 - 2014-06-02 19:10 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-02 19:10 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-02 19:10 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-05-10 18:08 - 2014-05-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-06 06:40 - 2014-05-15 17:55 - 23544320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-05-06 05:25 - 2014-05-15 17:55 - 17382912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-05-06 05:00 - 2014-05-15 17:55 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 17:55 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

Some content of TEMP:
====================
C:\Users\Sven\AppData\Local\Temp\avgnt.exe
C:\Users\Sven\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Sven\AppData\Local\Temp\KUIU.EXE
C:\Users\Sven\AppData\Local\Temp\ose00000.exe
C:\Users\Sven\AppData\Local\Temp\ose00001.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-06-01 22:50

==================== End Of Log ============================
         
Addition
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2014 01
Ran by Sven at 2014-06-02 21:47:01
Running from C:\Users\Sven\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.3.0.1 - Absolute Software)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 8.25.00 - )
Avira (HKLM-x32\...\{70a79d1f-686d-4d5c-962b-07aa1294eae0}) (Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{FE5ABB0E-EDEA-4023-B0FB-9DEA39A98D76}) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version:  - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version:  - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC) (Version: 8.8.0.17 - Canon Inc.)
Clonk Rage (HKLM-x32\...\Clonk Rage) (Version:  - RedWolf Design GmbH)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.9.0 - Conexant)
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{5A06C25A-366E-46CC-880E-3F904B634E9E}) (Version:  - Microsoft)
Die Siedler 7 (HKLM-x32\...\{63860309-DA8A-4BAE-9EAE-CE1D6D79340C}) (Version: 1.12.1396 - Ubisoft)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10239 - Realtek Semiconductor Corp.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) PRO/Wireless Driver (Version: 16.10.0000.1228 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.5) (HKLM\...\{302600C1-6BDF-4FD1-1307-148929CC1385}) (Version: 3.1.1307.0362 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{B1AC3709-3E98-4F2C-A84E-4BCA2A452E64}) (Version: 4.2.40.2418 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{86b86e21-7c9b-4baa-b284-69ce4a918661}) (Version: 16.10.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.10.0.0307 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.10 - )
Lenovo Dependency Package (HKLM-x32\...\Lenovo Dependency Package_is1) (Version: 1.6.18.0 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.5.0 - Lenovo)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Peer Connect SDK (HKLM\...\{75C87855-9CBB-4892-B1A9-74C73A19CACA}_is1) (Version: 1.0.0.1 - Lenovo)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
Lenovo QuickControl (HKLM-x32\...\{4855C42F-5197-4AAD-A50D-5066D2CC4647}) (Version: 2.00 - Lenovo Group Limited)
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.2.2.0 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.3.0.10 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.0.0.16 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.1.0.5 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{C51863E5-EB09-43A5-9D43-26A32587EEAC}) (Version: 2.4.002.00 - Lenovo Group Limited)
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
Lenovo Transition (HKLM\...\{660FFFA1-BC46-4B79-A3B5-E51D8964FF1F}) (Version: 1.0.002.00 - Lenovo Group Limited)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0012.00 - Lenovo Group Limited)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)
LenovoEMC Storage Connector (HKLM\...\LenovoEMC) (Version: 1.1.2.26394 - LenovoEMC)
Locomotion (HKLM-x32\...\{77F45E76-E897-42CA-A9FE-5F56817D875C}) (Version: 1.00.000 - )
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.1.3.5000 - Maxthon International Limited)
Microsoft Access MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Groove MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Lync MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Word MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
Nitro Pro 8 (HKLM\...\{84DAF9F1-513C-49F8-89D2-63CB3F4A7E39}) (Version: 8.5.7.1 - Nitro)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 2.1.1.0 - Lenovo)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.21234 - Realtek Semiconductor Corp.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
ThinkPad OneLink Dock (HKLM-x32\...\{8E1CACF5-2493-4950-9AD5-189903FE57E7}) (Version: 1.08.25 - Lenovo)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.40 - Synaptics Incorporated)
Thinkpad USB 3.0 Ethernet Adapter Driver (HKLM-x32\...\{D8102684-7BA1-4948-88B9-535F84E6E588}) (Version: 8.8.911.2013 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.78.0.10 - Lenovo)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version:  - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{237834D6-FA98-44E1-8739-ABD56DDADC59}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version:  - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{EF77B4A6-DFEC-4010-A87D-9B6BF87FABEC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{62857CDD-2985-4939-91BA-19ED0B0031A5}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{0814662C-FD28-4DE0-ACE5-EE50D1D6C8FB}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2826040) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{C4AEA56A-0759-4D08-9FAB-31A92137D0B8}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2837644) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D692E9FF-84BF-4F44-A0EA-D58ECE0D538E}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863825) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{327EABFD-EDD3-44E7-AB47-7592DF33B719}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{290D80DE-03AB-47EC-9402-108AF4CE4F66}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863844) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{50F31E04-D56A-4159-BF36-CF3CE27DB30C}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880464) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{88B29AA5-71EE-4692-91E2-E89407F0B783}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880476) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D3FC5B59-0F86-4B9A-94DF-FC213DF4FA63}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880476) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D3FC5B59-0F86-4B9A-94DF-FC213DF4FA63}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880478) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{8116ED50-F1E7-49E1-9D8D-421497D34B0F}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0090-0407-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00BA-0407-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00A1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version:  - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{34A169EC-990A-4DAE-AC65-9F981158B7DB}) (Version:  - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUS_{34A169EC-990A-4DAE-AC65-9F981158B7DB}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2878315) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{95F0CF54-BC3E-4C6F-B11D-89D6D8C6452E}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2878315) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{95F0CF54-BC3E-4C6F-B11D-89D6D8C6452E}) (Version:  - Microsoft)
Update for Microsoft Publisher 2013 (KB2726952) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{03B2C707-503D-4979-8322-CA92C45AD6B4}) (Version:  - Microsoft)
Update for Microsoft Publisher 2013 (KB2726952) 64-Bit Edition (HKLM\...\{90150000-0019-0407-1000-0000000FF1CE}_Office15.PROPLUS_{03B2C707-503D-4979-8322-CA92C45AD6B4}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2878319) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{BC51FE30-3A56-4802-8D9E-E9BC05B56B49}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version:  - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version:  - Microsoft)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows-Treiberpaket - Intel Corporation (iaStorA) HDC  (08/01/2013 12.8.0.1016) (HKLM\...\C8A921233C0C441A4E4EAABC2AB08C872FD77A6E) (Version: 08/01/2013 12.8.0.1016 - Intel Corporation)
Windows-Treiberpaket - Intel hdc  (07/25/2013 9.4.0.1023) (HKLM\...\87403FF3ADDFA1770936C9436A187AC3B9FBC8DE) (Version: 07/25/2013 9.4.0.1023 - Intel)
Windows-Treiberpaket - Intel System  (07/25/2013 9.4.0.1023) (HKLM\...\BDBD400472735932E15286ACD00A1DA1856D2B6D) (Version: 07/25/2013 9.4.0.1023 - Intel)
Windows-Treiberpaket - Intel System  (08/21/2013 9.4.0.1027) (HKLM\...\FC58A12A405BF6933FC97269FF68C969D128F381) (Version: 08/21/2013 9.4.0.1027 - Intel)
Windows-Treiberpaket - Intel USB  (07/31/2013 9.4.0.1025) (HKLM\...\A6995A77D26D0B0292A9C3B4878836D232899FE0) (Version: 07/31/2013 9.4.0.1025 - Intel)
Windows-Treiberpaket - Lenovo 1.67.04.04 (11/07/2013 1.67.04.04) (HKLM\...\70FB73D983446AEE2932B0ED51A770D1BD1348DA) (Version: 11/07/2013 1.67.04.04 - Lenovo)
Windows-Treiberpaket - Synaptics (SmbDrv) System  (10/23/2013 17.0.12.52) (HKLM\...\546FF7E8ABB3021DB74C663BFEAB0780589F2990) (Version: 10/23/2013 17.0.12.52 - Synaptics)
Windows-Treiberpaket - Synaptics (SynTP) Mouse  (10/23/2013 17.0.12.52) (HKLM\...\D4AF752691BC44E5CA6E33BDDD57F0845B4AEBFE) (Version: 10/23/2013 17.0.12.52 - Synaptics)

==================== Restore Points  =========================

01-06-2014 21:00:14 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {05334FF9-1CDA-4490-AD94-B0755297FB44} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-12-02] ()
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {25739816-833E-4491-9EEC-CEAEA6D43B04} - System32\Tasks\Lenovo\LSC\LSCTaskService => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCTaskService.exe [2014-02-19] ()
Task: {258A02C5-BFD1-4B8A-BFCF-A9E49A48747D} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {542B2977-85AE-4FE2-A45D-C0B410AE9E04} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {5A94C214-BD26-466C-AEB8-1D340589E949} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\WINDOWS\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
Task: {69BB9B34-37B2-45E8-BA8F-77E6A74FE490} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6D06CDF9-F205-4A14-9195-0892C1366F63} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-09-06] (Lenovo)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {75FA41DE-05EF-4EBC-8074-DEA88CDA1242} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {8323D2F6-1585-4F3C-A86E-FED3DBD35B94} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {83D9DC2E-BFCB-490F-B1BC-3964C36C3775} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\SystemAgent\AutoUpdate.exe [2013-12-02] ()
Task: {8409FF72-643C-481F-B604-911418A5B423} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {85D82A54-4049-45AF-86C7-5B0C5ED7EE1D} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {91A46576-4A74-46E7-A77A-95A7015ABAB5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-19] (Lenovo)
Task: {9886A1D3-EF2A-464B-ADFF-2D34B7B03B6D} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\mxup.exe [2013-10-14] (Maxthon International ltd.)
Task: {9ACE9655-F1F9-424C-AFA6-129FE040094B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-05-21] (Microsoft Corporation)
Task: {9FD54121-2FFE-47F9-B550-2B8A5200D69E} - System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2014-04-08] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B43EF720-147B-45C8-B9BD-42C6EFC68297} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {B4BB04DF-BA25-4264-BB38-D67B60C9EC7D} - System32\Tasks\Lenovo\Lenovo Transition Launcher => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [2013-09-05] ()
Task: {CB6E00AD-B0EF-46DA-9D59-6F9522B058B2} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D1C6A86A-7B1B-426D-9CA6-DDF1496A2444} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {D41EB82C-9148-4A31-9DA7-9BCF03F0D10A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DEC0A285-D8EB-48D5-B5BA-FCFCB072A52E} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-02-19] ()
Task: {E529073A-7EB0-47FA-9A88-C176DEB5246E} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-02-19] ()
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EC5F0637-1B34-4BC3-8B03-7B12B1AA5AD0} - System32\Tasks\StartLenovoEMCDiscovery => C:\Program Files\LenovoEMC\StorageConnector\StartLenovoEMCDiscovery.cmd [2014-04-08] ()
Task: {F1DBCFC6-B7AA-4E3C-AF41-32FE8323F0A8} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {F1F512EF-E969-48CE-8322-F478E44F5BEE} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-02-19] (Lenovo)

==================== Loaded Modules (whitelisted) =============

2013-08-01 18:31 - 2013-08-01 18:31 - 00198120 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-08-01 18:31 - 2013-08-01 18:31 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2013-08-01 18:31 - 2013-08-01 18:31 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2014-03-17 01:57 - 2013-11-21 08:44 - 00117248 _____ () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2014-01-28 06:43 - 2013-12-11 15:36 - 00468288 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-01-28 06:44 - 2013-12-11 15:36 - 00013120 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2014-03-17 01:57 - 2013-11-21 08:44 - 00117248 _____ () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2013-09-05 18:28 - 2013-09-05 18:28 - 00292200 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-04-05 11:49 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-09-05 18:28 - 2013-09-05 18:28 - 00106856 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2014-01-28 06:13 - 2013-10-28 17:48 - 00915968 _____ () C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe
2014-04-16 21:27 - 2014-02-25 11:41 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-28 06:40 - 2014-01-28 06:40 - 00033520 _____ () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\66db718389f1cd2503053c09b3de857f\Windows.Networking.ni.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 01282048 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Devices\bf5509cf3a0d2e3afbd0c33e9153ecbd\Windows.Devices.ni.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\cf021988965369c551bb0987fe019862\Windows.Foundation.ni.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-01-28 06:11 - 2013-09-16 21:19 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-09-05 18:28 - 2013-09-05 18:28 - 00097128 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2013-09-05 18:28 - 2013-09-05 18:28 - 00101224 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2014-04-16 21:28 - 2014-05-05 10:37 - 00049744 _____ () C:\Users\Sven\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 03019888 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-05-10 18:08 - 2014-05-10 18:08 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Sven\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/02/2014 09:43:21 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 06:38:13 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 05:48:57 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 04:50:22 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 07:49:14 AM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 10:34:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.10.0.0, Zeitstempel: 0x52cda7eb
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.10.0.0, Zeitstempel: 0x52cda6c5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcd8
ID des fehlerhaften Prozesses: 0xc90
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3
Vollständiger Name des fehlerhaften Pakets: ZeroConfigService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ZeroConfigService.exe5

Error: (06/01/2014 10:33:03 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/01/2014 09:27:18 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 06:00:19 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 05:27:50 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0


System errors:
=============
Error: (06/02/2014 05:49:15 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.26
registriert werden. Der Computer mit IP-Adresse 192.168.178.25 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (06/02/2014 05:49:05 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Canon - Printers - Canon MP550 series Printer

Error: (06/02/2014 05:00:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/01/2014 10:42:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/01/2014 10:35:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/01/2014 10:33:23 PM) (Source: DCOM) (EventID: 10016) (User: KLAGGES)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}KlaggesSvenS-1-5-21-1282787320-2724149473-996529921-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (06/01/2014 10:33:21 PM) (Source: DCOM) (EventID: 10016) (User: KLAGGES)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}KlaggesSvenS-1-5-21-1282787320-2724149473-996529921-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (06/01/2014 10:33:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (06/01/2014 10:32:12 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎01.‎06.‎2014 um 21:33:20 unerwartet heruntergefahren.

Error: (06/01/2014 03:23:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (06/02/2014 09:43:21 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 06:38:13 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 05:48:57 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 04:50:22 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/02/2014 07:49:14 AM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 10:34:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe16.10.0.052cda7ebMurocApi.dll16.10.0.052cda6c5c0000005000000000002bcd8c9001cf7dd8ac628f8fC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dll119168cd-e9cc-11e3-8278-f17b3b496181

Error: (06/01/2014 10:33:03 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (06/01/2014 09:27:18 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 06:00:19 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0

Error: (06/01/2014 05:27:50 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring   Unable to connect to the keyboard filter driver, error=0


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 8108.03 MB
Available physical RAM: 5682.27 MB
Total Pagefile: 9388.03 MB
Available Pagefile: 6291.18 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:453.71 GB) (Free:314.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 658E0480)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: EE4C3036)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
defogger_disable
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:43 on 02/06/2014 (Sven)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
GMER
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-03 00:03:57
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000031 WDC_WD5000LPVX-08V0TT5 rev.05.01A05 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Sven\AppData\Local\Temp\kwrdqpod.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                                                                            fffff960000c8c00 15 bytes [00, 8E, 0B, 02, 80, 32, 6E, ...]
.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                                                                       fffff960000c8c10 11 bytes [00, 41, FC, FF, C0, 7D, F9, ...]

---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                               00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                               00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                  00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                  00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                               00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                               00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                  00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                  00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                    00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                    00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                       00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                       00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                          00007ffd48461f6a 4 bytes [46, 48, FD, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                          00007ffd48461f82 4 bytes [46, 48, FD, 7F]
.text   C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506  00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514  00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118     00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142     00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                   00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                   00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                         00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                         00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                            00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                            00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                         00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                         00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                            00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                            00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                    00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                    00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                              00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                              00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text   C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [5512:2640]                                                                                                  fffff9600088cb90
Thread  C:\Windows\System32\SettingSyncHost.exe [7360:4500]                                                                                        00007ffd48724b30

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
         

Alt 03.06.2014, 06:54   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



hi,

Zitat:
Ich hab bereits zweimal das Passwort geändert, aber zumindest nach dem ersten Mal sind neue Spammails aufgetaucht.
und nach dem zweiten Mal? Und selbst wenn noch welche auftauchen, bitte checken ob es keine Rückläufer sind. In 99% der Fälle werden die Accounts online gehackt, ohne Zutun von Malware auf dem Rechner.
__________________

__________________

Alt 03.06.2014, 16:57   #3
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Wie lange sollte ich denn dann warten? Also wie lange dauert es, bis auch Rückläufer etc. raus/ausgeschlossen sind?
Und muss ich dann, um das einzuschätzen, nur Mails ernstnehmen, die direkt von meinem Account aus kommen? Ich meine, dass jemand jetzt die ganzen Kontakte hat und einfach einen Account verwendet, der meinem ähnelt, dagegen kann ich vermutlich nichts machen, oder?
__________________

Alt 04.06.2014, 12:29   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Nein dagegen kannst Du nix machen, is aber selten. Ne Woche oder 2 sollten Rückläufer ausschliessen.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.06.2014, 17:18   #5
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Danke schonmal für die Hinweise so weit. Aber heute wollte ich auf eine Mail eines Freundes antworten und es kam eine Fehlermeldung und die Bitte eine Sicherheitsausnahmeregelung hinzuzufügen. Ein Bild davon habe ich angehängt, da ich es nicht geschafft habe es hier in den Text einzufügen.
Hat mich stutzig gemacht. Ist das ein Zufall, oder kann es da einen Zusammenhang geben. Ich habe schon bei Yahoo geguckt, welche Angaben die machen. Das steht unter Einstellungen:
"Ausgehend: SMTP smtp.mail.yahoo.com 465 SSL/TLS Normales Passwort"
Scheint also eigentlich zu stimmen. Ich hab jetzt aber erstmal auf das Versenden verzichtet, war mir zu unsicher mit dieser Ausnahmeregelung.

Miniaturansicht angehängter Grafiken
Emailaccount sendet Spam an Adressen aus der Kontaktliste-fehlermeldung-thunderbird.jpg  

Alt 05.06.2014, 17:51   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Das kann die am besten der Support von Yahoo beantworten, kenne ich jetzt so auch nicht.
__________________
--> Emailaccount sendet Spam an Adressen aus der Kontaktliste

Alt 06.06.2014, 14:57   #7
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Die äußern sich nicht, aber inzwischen geht's wieder ohne die Fehlermeldung. Meldungen wegen Spamnachrichten sind auch weniger geworden und offenbar nach Montag Morgen keine mehr dazu gekommen, denn die letzten gemeldeten sind alle Sonntag oder Montag morgens versandt worden. Ich bin 4 Tage weg. Ich melde mich dann auf jeden Fall Dienstag einmal, ob in den 4 Tagen was passiert ist und hoffe, dass es das dann gewesen ist.
Vielen Dank schonmal für die Hilfe, es hilft ja auch schon, wenn jemand mit Ahnung einem sagt, dass es offenbar halb so schlimm ist!

Alt 07.06.2014, 06:07   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



ok
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 10.06.2014, 20:11   #9
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Moin,
die letzten Tage ist es zum Glück ruhig geblieben. Ich wurde lediglich über eine Mail von Samstag informiert, die aber als Absender "meineAdresse"@yahoo.com hatte. Hast du ja schon gesagt, dass ich darauf keinen Einfluss nehmen kann. Ich hoffe, dass damit dann alles gut ist. Vielen Dank für die freundliche Betreuung! Muss ich jetzt noch etwas auf meinem Rechner wieder entfernen oder rückgängig machen?
Grüße
Sven

Alt 11.06.2014, 19:59   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Dann räumen wir mal auf:

Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 15.06.2014, 13:07   #11
Jekub
 
Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Super, vielen Dank auch für die Tipps, ich werde euch weiterempfehlen!

Alt 16.06.2014, 07:34   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Emailaccount sendet Spam an Adressen aus der Kontaktliste - Standard

Emailaccount sendet Spam an Adressen aus der Kontaktliste



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Emailaccount sendet Spam an Adressen aus der Kontaktliste
.com, akamai, antivirus, association, avira, bildschirm, bluestacks, browser, excel, feedback, festplatte, firefox, flash player, homepage, mozilla, object, onedrive, outlook 2013, programm, pwmtr64v.dll, realtek, registry, rundll, scan, security, software, svchost.exe, system, taskmanager, tracker, usb, windows



Ähnliche Themen: Emailaccount sendet Spam an Adressen aus der Kontaktliste


  1. 1&1 Email Adressen senden Spam
    Überwachung, Datenschutz und Spam - 27.04.2016 (38)
  2. mail account sendet spam
    Plagegeister aller Art und deren Bekämpfung - 16.10.2013 (9)
  3. Windows Server 2008 R2 sendet an IP-Adressen ins Internet
    Plagegeister aller Art und deren Bekämpfung - 10.09.2013 (4)
  4. eMail Account sendet unaufgefordert Spam-Mails
    Plagegeister aller Art und deren Bekämpfung - 01.02.2013 (1)
  5. Gmx-Account sendet Spam-Mails
    Plagegeister aller Art und deren Bekämpfung - 29.07.2012 (11)
  6. Gehackte web.de Adressen für Verschlüsselungs-Trojaner SPAM missbraucht
    Diskussionsforum - 14.07.2012 (0)
  7. (2x) erst verschlüsselungstrojaner und jetzt sendet mein emailaccount
    Mülltonne - 18.06.2012 (1)
  8. (2x) Hotmail Emailaccount verschickt "spam" mails an Kontakte
    Mülltonne - 20.05.2012 (1)
  9. Mail ACC sendet SPAM Mails
    Plagegeister aller Art und deren Bekämpfung - 05.04.2012 (2)
  10. spam von meinem konto an kontaktliste bei hotmail
    Plagegeister aller Art und deren Bekämpfung - 09.11.2011 (5)
  11. Versende unbewusst Spam an die Kontaktliste (hotmail)
    Plagegeister aller Art und deren Bekämpfung - 16.06.2011 (11)
  12. Mail sendet selbständig Nachrichten an alle Adressen
    Plagegeister aller Art und deren Bekämpfung - 19.08.2010 (2)
  13. MSN sendet Links an Kontaktliste
    Plagegeister aller Art und deren Bekämpfung - 10.03.2010 (3)
  14. Spam sendet aus meinem Account
    Überwachung, Datenschutz und Spam - 20.05.2009 (4)
  15. MSN sendet automatisch SPAM
    Log-Analyse und Auswertung - 15.08.2008 (1)
  16. Mein Rechner sendet SPAM?
    Überwachung, Datenschutz und Spam - 25.03.2008 (17)
  17. PC langsam (!) und sendet spam (?)
    Log-Analyse und Auswertung - 17.03.2008 (11)

Zum Thema Emailaccount sendet Spam an Adressen aus der Kontaktliste - Hallo, seit 2 Tagen sendet einer meiner yahoo-emailaccounts Spammails an meine Kontaktliste. Ich hab bereits zweimal das Passwort geändert, aber zumindest nach dem ersten Mal sind neue Spammails aufgetaucht. Die - Emailaccount sendet Spam an Adressen aus der Kontaktliste...
Archiv
Du betrachtest: Emailaccount sendet Spam an Adressen aus der Kontaktliste auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.