Hallo,
ich habe seit einigen Tagen das Problem, dass ich Musik (evtl. stammt sie vom beginn einer Werbung) und einblendungen von "Sportnachrichten", vorranging ging es dabei um einen wechsel von L. Podolski neuerdings um einen Wechsel von Shaqiri. Diese Werbung ist teilweise sehr laut. Jetzt auch noch eine Stimme die Verkündet, dass die neue Single von Rita Ora erst später erscheint.
Dazu habe ich festgestellt, dass ab und an auch ganz leise (kaum hörbar) Werbung, vermutlich in Englischer Sprache eingespielt wird.
Ich weiß nicht ob es in einem zusammenhangsteht, aber ich möchte noch erwähnen das ich letzte Woche beim Surfen eben auch auf so einen "Ich sperr deinen Browser bis du mir 100 Euro per Paisafecard schickst" Trojaner gestoßen, den ich aber schließen konnte.

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:44 on 10/01/2015 (Jörg)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Jörg (administrator) on JÖRG-PC on 10-01-2015 13:46:35
Running from C:\Users\Jörg\Downloads
Loaded Profile: Jörg (Available profiles: Jörg)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595336 2014-10-01] (ESET)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\MountPoints2: {5178856f-d3d3-11e3-aafe-806e6f6e6963} - D:\Bin\assetup.exe
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse] => "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] => "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-06] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_246_Plugin.exe -update plugin
Startup: C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: DownloadHelper - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-11-28]
FF Extension: Adblock Plus - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-12]
FF Extension: Fox!Box - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi [2014-12-09]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR StartupUrls: Default -> "hxxp://Vosteran.com/?f=7&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=", "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (Google Drive) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-03]
CHR Extension: (YouTube) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-12-26]
CHR Extension: (Google Mail) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1349576 2014-10-01] (ESET)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Verifies and fixes application compatibility issues; C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [87208 2014-12-31] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-09-22] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [241368 2014-09-22] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [169280 2014-09-22] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [158968 2014-09-22] (ESET)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 13:46 - 2015-01-10 13:46 - 00012086 _____ () C:\Users\Jörg\Downloads\FRST.txt
2015-01-10 13:46 - 2015-01-10 13:46 - 00000000 ____D () C:\FRST
2015-01-10 13:45 - 2015-01-10 13:46 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64.exe
2015-01-10 13:44 - 2015-01-10 13:44 - 00000470 _____ () C:\Users\Jörg\Downloads\defogger_disable.log
2015-01-10 13:44 - 2015-01-10 13:44 - 00000000 _____ () C:\Users\Jörg\defogger_reenable
2015-01-10 13:43 - 2015-01-10 13:43 - 00050477 _____ () C:\Users\Jörg\Downloads\Defogger.exe
2015-01-10 13:10 - 2015-01-10 13:10 - 00000624 _____ () C:\Users\Jörg\Desktop\JRT.txt
2015-01-10 01:53 - 2015-01-10 01:53 - 00000000 ____D () C:\Users\Jörg\AppData\Local\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\Program Files\ESET
2015-01-10 00:33 - 2015-01-10 00:33 - 01761992 _____ (ESET) C:\Users\Jörg\Downloads\eset_nod32_antivirus_live_installer_.exe
2015-01-09 17:58 - 2015-01-09 17:58 - 00000000 __SHD () C:\Users\Jörg\AppData\Local\EmieBrowserModeList
2015-01-09 17:56 - 2015-01-09 17:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-09 17:55 - 2015-01-09 17:56 - 02347384 _____ (ESET) C:\Users\Jörg\Downloads\esetsmartinstaller_deu.exe
2015-01-09 17:51 - 2015-01-09 17:51 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107.exe
2015-01-09 17:49 - 2015-01-09 17:49 - 00000000 ____D () C:\Windows\ERUNT
2015-01-09 17:48 - 2015-01-09 17:48 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT.exe
2015-01-09 17:38 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 17:36 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Dropbox
2015-01-09 17:35 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150109-173535.backup
2015-01-09 16:24 - 2015-01-09 17:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-09 16:24 - 2015-01-09 16:35 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2015-01-09 16:24 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-09 14:38 - 2015-01-09 14:38 - 00250657 _____ () C:\ProgramData\1420809997.bdinstall.bin
2015-01-07 16:44 - 2015-01-07 16:44 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TrojanHunter
2015-01-07 15:27 - 2015-01-09 16:27 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2015-01-07 15:27 - 2015-01-07 15:27 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2015-01-06 10:26 - 2015-01-06 10:26 - 00292776 _____ () C:\Windows\Minidump\010615-13197-01.dmp
2015-01-05 18:18 - 2015-01-10 13:06 - 00000000 ____D () C:\AdwCleaner
2015-01-04 23:45 - 2015-01-04 23:45 - 00000000 ____D () C:\Users\Jörg\Documents\Klei
2015-01-04 01:33 - 2015-01-04 01:33 - 00002212 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2015-01-04 01:33 - 2015-01-04 01:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2015-01-01 21:52 - 2015-01-02 12:26 - 00000000 ____D () C:\Users\Jörg\Documents\gg
2015-01-01 08:08 - 2015-01-10 12:39 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier
2014-12-31 17:29 - 2015-01-02 02:40 - 00000000 ____D () C:\Program Files\Recuva
2014-12-31 17:29 - 2014-12-31 17:29 - 00001658 _____ () C:\Users\Public\Desktop\Recuva.lnk
2014-12-31 17:17 - 2014-12-31 17:20 - 00000000 ____D () C:\SeaTemp
2014-12-30 23:05 - 2014-12-30 23:05 - 00007236 _____ () C:\Users\Jörg\Documents\poxxparty.xspf
2014-12-30 22:29 - 2014-12-31 17:14 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner
2014-12-30 21:35 - 2015-01-09 17:21 - 00000000 ____D () C:\Users\Jörg\Documents\festlatte
2014-12-27 13:34 - 2014-12-27 13:34 - 00296888 _____ () C:\Windows\Minidump\122714-12230-01.dmp
2014-12-26 22:43 - 2014-12-26 22:43 - 00000000 ____D () C:\Users\Jörg\Documents\BB FlashBack Express 5 Updates
2014-12-26 22:33 - 2014-12-26 22:33 - 00296856 _____ () C:\Windows\Minidump\122614-14352-01.dmp
2014-12-26 19:37 - 2014-12-26 19:37 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-12-26 19:24 - 2014-12-26 19:39 - 00000408 _____ () C:\Windows\system32\checkdnsid.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00540145 _____ () C:\ProgramData\1419616801.bdinstall.bin
2014-12-26 19:05 - 2014-12-26 19:05 - 00000385 _____ () C:\Windows\system32\user_gensett.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____D () C:\ProgramData\BDLogging
2014-12-26 19:05 - 2013-11-04 16:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-12-26 19:05 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2014-12-26 19:05 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2014-12-26 19:00 - 2015-01-09 14:39 - 00000000 ____D () C:\Program Files\Bitdefender
2014-12-26 19:00 - 2014-12-26 19:36 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll
2014-12-26 19:00 - 2014-12-26 19:35 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll
2014-12-26 01:04 - 2015-01-09 14:37 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-12-25 23:51 - 2014-12-25 23:51 - 00001173 _____ () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00001121 _____ () C:\Users\Jörg\Desktop\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\FreeFLVConverter
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter
2014-12-25 23:51 - 2014-10-14 11:00 - 00397312 _____ () C:\Windows\SysWOW64\TubeFinder.exe
2014-12-25 23:51 - 2011-09-22 11:05 - 01081616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2014-12-25 23:51 - 2011-09-22 11:05 - 00152848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2014-12-25 23:50 - 2014-12-26 01:04 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2014-12-19 13:00 - 2014-12-19 12:04 - 01510216 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-12-04-50.log
2014-12-19 12:27 - 2014-12-19 12:01 - 00616683 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-11-59-05.log
2014-12-19 11:19 - 2014-12-19 11:19 - 00000000 ____D () C:\Users\Jörg\Desktop\screenshots
2014-12-18 09:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 09:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 18:56 - 2014-12-17 18:56 - 00293408 _____ () C:\Windows\Minidump\121714-11138-01.dmp
2014-12-17 18:43 - 2014-12-17 18:43 - 00293384 _____ () C:\Windows\Minidump\121714-11856-01.dmp
2014-12-15 07:22 - 2014-12-15 07:22 - 00293376 _____ () C:\Windows\Minidump\121514-14430-01.dmp
2014-12-12 20:39 - 2014-12-12 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (3)
2014-12-12 09:52 - 2014-12-16 05:13 - 00000000 ____D () C:\Program Files (x86)\BEAF8266-AE64-40A2-BF8D-99F4FB145C26

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 13:44 - 2014-05-04 22:36 - 00000000 ____D () C:\Users\Jörg
2015-01-10 13:43 - 2014-12-05 21:17 - 00000682 _____ () C:\Users\Jörg\Desktop\Neues Textdokument.txt
2015-01-10 13:37 - 2014-05-13 12:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-10 13:32 - 2014-05-05 07:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-10 13:05 - 2014-10-03 13:16 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Skype
2015-01-10 12:42 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-10 12:42 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-10 12:38 - 2014-10-15 23:25 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.EU
2015-01-10 12:37 - 2014-11-26 19:49 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.NET
2015-01-10 12:36 - 2014-05-04 22:36 - 01753535 _____ () C:\Windows\WindowsUpdate.log
2015-01-10 12:34 - 2014-05-13 12:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-10 12:34 - 2014-05-05 07:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-10 12:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-10 12:34 - 2009-07-14 05:51 - 00030252 _____ () C:\Windows\setupact.log
2015-01-10 04:41 - 2014-11-28 15:14 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\vlc
2015-01-10 03:06 - 2014-11-26 00:04 - 00000000 ____D () C:\Users\Jörg\Desktop\tN-.]H$!
2015-01-10 02:00 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-10 02:00 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-10 02:00 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-10 00:36 - 2014-05-06 14:12 - 00354276 _____ () C:\Windows\PFRO.log
2015-01-10 00:35 - 2014-05-05 07:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-10 00:35 - 2014-05-05 07:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-10 00:35 - 2014-05-05 07:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-10 00:34 - 2014-05-05 07:57 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 00:31 - 2014-05-13 12:24 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Adobe
2015-01-10 00:28 - 2014-10-03 12:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 17:59 - 2014-11-25 04:59 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Macro Toolworks
2015-01-09 17:58 - 2014-05-13 12:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-09 14:00 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-09 03:12 - 2014-11-28 04:26 - 00000000 ____D () C:\Users\Jörg\dwhelper
2015-01-07 15:28 - 2014-10-03 12:11 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-07 15:23 - 2014-10-24 22:20 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TS3Client
2015-01-06 10:26 - 2014-05-13 14:08 - 00000000 ____D () C:\Windows\Minidump
2015-01-06 10:26 - 2014-05-13 14:07 - 648425529 _____ () C:\Windows\MEMORY.DMP
2015-01-06 04:36 - 2014-05-05 07:49 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 18:18 - 2014-12-06 20:03 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\QuickScan
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ____D () C:\ProgramData\Skype
2015-01-04 19:56 - 2014-11-26 19:48 - 00000000 ____D () C:\Program Files (x86)\PokerStars.NET
2015-01-04 03:08 - 2014-10-08 19:25 - 00000000 ____D () C:\Users\Jörg\Documents\my games
2015-01-04 01:33 - 2014-05-13 12:27 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Google
2015-01-03 16:09 - 2014-10-15 23:25 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-12-31 16:58 - 2014-11-26 00:08 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Blueberry
2014-12-26 22:48 - 2014-11-26 00:08 - 00001420 _____ () C:\Users\Public\Desktop\BB FlashBack Express Recorder.lnk
2014-12-26 22:48 - 2014-11-26 00:08 - 00001410 _____ () C:\Users\Public\Desktop\BB FlashBack Express Player.lnk
2014-12-19 14:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\Jörg\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 11:12

==================== End Of Log ============================
         

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by Jörg at 2015-01-10 13:47:31
Running from C:\Users\Jörg\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET NOD32 Antivirus 8.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: ESET NOD32 Antivirus 8.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4K Video Downloader 3.4 (HKLM-x32\...\4K Video Downloader_is1) (Version: 3.4.5.1525 - Open Media LLC)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
BB FlashBack Express 5 (HKLM-x32\...\BB FlashBack Express 5) (Version: 5.4.0.3442 - Blueberry)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version:  - Klei Entertainment)
Dropbox (HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\Dropbox) (Version: 3.0.4 - Dropbox, Inc.)
ESET NOD32 Antivirus (HKLM\...\{9EEE5827-F6A6-447E-9839-6AFAF6FCC442}) (Version: 8.0.304.4 - ESET, spol s r. o.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Free FLV Converter V 7.6.2 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.2.0 - Koyote Lab Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
KeyCommander 1.3.1 (HKLM-x32\...\KeyCommander) (Version: 1.3.1 - fabi.me)
Life is Feudal: Your Own (HKLM-x32\...\Steam App 290080) (Version:  - Bitbox Ltd.)
ManyCam 3.1.51 (HKLM-x32\...\ManyCam) (Version: 3.1.51 - ManyCam LLC)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Open Office Packages (HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\Open Office Packages) (Version:  - ) <==== ATTENTION
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Poker at bet365 (HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\bet365poker) (Version:  - )
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
PokerStars.net (HKLM-x32\...\PokerStars.net) (Version:  - PokerStars.net)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Robocraft (HKLM-x32\...\Steam App 301520) (Version:  - Freejam)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Tropico 3 - Steam Special Edition (HKLM-x32\...\Steam App 23490) (Version:  - Haemimont Games)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

09-01-2015 20:30:41 Geplanter Prüfpunkt
09-01-2015 20:37:21 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {16469745-C0E4-45C4-A525-E29BDD6363EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {28BBB617-5305-408E-91DB-BB51A0009ECA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {4CB1FE30-CCF6-4C5B-A8D3-378E102B0DF4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {5CD30E1C-C4C6-49C6-BAA8-3EF2F5DFE88D} - System32\Tasks\arp_flush => C:\Program Files (x86)\hide.me VPN\FlushArpCache.exe [2014-11-26] ()
Task: {72FCE252-493A-4119-958D-A6101F085469} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {AAFCE020-5809-442D-B013-64BFB80E1590} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {E785A859-D3A2-473D-82BD-16882854DCAF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-10] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-05-05 07:51 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-01 08:08 - 2014-12-31 16:27 - 00087208 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
2015-01-01 08:08 - 2014-12-31 18:13 - 39577768 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
2015-01-09 16:24 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-09 16:24 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-09 16:24 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-09 16:24 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-09 16:24 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 01360552 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libglesv2.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 00214184 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libegl.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 00985768 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll
2015-01-01 18:19 - 2015-01-10 00:35 - 16843952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll
2014-12-02 03:24 - 2014-12-02 03:24 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:B449BECA

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Hide.me => C:\Program Files (x86)\hide.me VPN\Hide.me.exe
MSCONFIG\startupreg: ManyCam => "C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe" /silent
MSCONFIG\startupreg: MurGee.com Auto Keyboard => C:\ProgramData\Auto Keyboard\AutoKeyboard.exe :silent
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

========================= Accounts: ==========================

Administrator (S-1-5-21-4201028278-1513335983-2328483318-500 - Administrator - Disabled)
Gast (S-1-5-21-4201028278-1513335983-2328483318-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4201028278-1513335983-2328483318-1002 - Limited - Enabled)
Jörg (S-1-5-21-4201028278-1513335983-2328483318-1000 - Administrator - Enabled) => C:\Users\Jörg

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
Percentage of memory in use: 25%
Total physical RAM: 16351.14 MB
Available physical RAM: 12228.1 MB
Total Pagefile: 32700.46 MB
Available Pagefile: 28346.87 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:648.89 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:924.93 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (Speed) (Fixed) (Total:119.14 GB) (Free:119.02 GB) NTFS
Drive h: (UUI) (Removable) (Total:29.8 GB) (Free:6.22 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 107AAA7E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 3CFE83F3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D48BF4AD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 29.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-10 13:58:50
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD10EZEX-00RKKA0 rev.80.00A80 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\JRG~1\AppData\Local\Temp\kxldypod.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1420] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                        0000000075f68791 4 bytes [C2, 04, 00, 00]
.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1420] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                             0000000075321465 2 bytes [32, 75]
.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1420] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                            00000000753214bb 2 bytes [32, 75]
.text    ...                                                                                                                                                                                                               * 2
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2052] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                       0000000075321465 2 bytes [32, 75]
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[2052] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                      00000000753214bb 2 bytes [32, 75]
.text    ...                                                                                                                                                                                                               * 2
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2916] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                      0000000075321465 2 bytes [32, 75]
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2916] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                     00000000753214bb 2 bytes [32, 75]
.text    ...                                                                                                                                                                                                               * 2
---- Processes - GMER 2.1 ----

Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [2624](2015-01-01 07:08:45)  0000000000400000
Library  C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0E05036D-666D-4AC0-A8C6-FE2F8E0FDD70}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2300](2015-01-10 11:47:09)                 000007fef7970000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [4272](2015-01-01 07:08:45)        0000000001390000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [4584](2015-01-01 07:08:45)        0000000001390000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [4620](2015-01-01 07:08:45)        0000000001390000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [4660](2015-01-01 07:08:45)        0000000001390000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [4908](2015-01-01 07:08:45)        0000000001390000

---- EOF - GMER 2.1 ----
         

Vielen Dank für eure Zeit und Aufmerksamkeit

hi,

Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

• Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den Programmen:
  
  Open Office Packages
  
  
  
• Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

 

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Erst einmal vielen Dank für deine wirklich extrem schnelle Antwort!
Ist es normal das Revo die ersten 2 cm vom Fortschrittsbalken recht rasant (binnen weniger Sekunden) macht und jetzt seit knapp 2 Stunden nicht einen Millimeter voranschreitet?
Das Open Office Package habe ich soweit problemlos auswählen können.
Den Moderatmodus ebenfalls.

Will einen Bedienerfehler hier nicht ausschließen, obwohl ich mich kleinig an die Anweisungen gehalten habe.

Darf ich den Rechner in dieser "Scanzeit" nutzen?

Nochmals vielen lieben Dank

Normal öffnet sich dann der Uninstaller der entsprechenden Software. Schau mal ob das nicht im Hintergrund in der Taskleiste liegt und auf Eingabe von dir wartet

Leider sehe ich keine Möglichkeit etwas einzugeben. Das ist der Zustand seit Stunden. Der Balken bewegt sich keinen Millimeter.

Soll ich die anderen Schritte trotzdem ausführen oder noch abwarten?

Gruß, WMS85

Minimiere alle Fenster, ist da wirklich kein Uninstaller Fenster der Software? Wenn nicht Revo beenden und nochmal starten.

Es waren nur die 2 Fenster geöffnet, welche ich gezeigt habe
Nach dem Revo neu gestartet wurde ist das "Open Office Packages" nicht mehr aufzufinden.

Darum hier noch mal frische logs vom Rechner:

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:43 on 10/01/2015 (Jörg)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST:


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Jörg (administrator) on JÖRG-PC on 10-01-2015 20:44:39
Running from C:\Users\Jörg\Downloads
Loaded Profile: Jörg (Available profiles: Jörg)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595336 2014-10-01] (ESET)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\MountPoints2: {5178856f-d3d3-11e3-aafe-806e6f6e6963} - D:\Bin\assetup.exe
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse] => "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] => "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-06] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_246_Plugin.exe -update plugin
Startup: C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: DownloadHelper - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-11-28]
FF Extension: Adblock Plus - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-12]
FF Extension: Fox!Box - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi [2014-12-09]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR StartupUrls: Default -> "hxxp://Vosteran.com/?f=7&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=", "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (Google Drive) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-03]
CHR Extension: (YouTube) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-12-26]
CHR Extension: (Google Mail) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1349576 2014-10-01] (ESET)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Verifies and fixes application compatibility issues; C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [87208 2014-12-31] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-09-22] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [241368 2014-09-22] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [169280 2014-09-22] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [158968 2014-09-22] (ESET)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 20:44 - 2015-01-10 20:45 - 00011999 _____ () C:\Users\Jörg\Downloads\FRST.txt
2015-01-10 20:43 - 2015-01-10 20:43 - 00000470 _____ () C:\Users\Jörg\Downloads\defogger_disable.log
2015-01-10 20:42 - 2015-01-10 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (4)
2015-01-10 20:41 - 2015-01-10 20:41 - 00003258 _____ () C:\Windows\System32\Tasks\{CD82DDA7-9231-4C19-9908-079D065BCB1C}
2015-01-10 20:39 - 2015-01-10 20:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jörg\Downloads\revosetup95.exe
2015-01-10 14:27 - 2015-01-10 14:27 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001.exe
2015-01-10 14:26 - 2015-01-10 14:26 - 00001268 _____ () C:\Users\Jörg\Desktop\Revo Uninstaller.lnk
2015-01-10 14:26 - 2015-01-10 14:26 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-10 13:51 - 2015-01-10 13:51 - 00380416 _____ () C:\Users\Jörg\Downloads\Gmer-19357.exe
2015-01-10 13:46 - 2015-01-10 20:44 - 00000000 ____D () C:\FRST
2015-01-10 13:45 - 2015-01-10 13:46 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64.exe
2015-01-10 13:44 - 2015-01-10 13:44 - 00000000 _____ () C:\Users\Jörg\defogger_reenable
2015-01-10 13:43 - 2015-01-10 13:43 - 00050477 _____ () C:\Users\Jörg\Downloads\Defogger.exe
2015-01-10 13:10 - 2015-01-10 13:10 - 00000624 _____ () C:\Users\Jörg\Desktop\JRT.txt
2015-01-10 01:53 - 2015-01-10 01:53 - 00000000 ____D () C:\Users\Jörg\AppData\Local\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\Program Files\ESET
2015-01-10 00:33 - 2015-01-10 00:33 - 01761992 _____ (ESET) C:\Users\Jörg\Downloads\eset_nod32_antivirus_live_installer_.exe
2015-01-09 17:58 - 2015-01-09 17:58 - 00000000 __SHD () C:\Users\Jörg\AppData\Local\EmieBrowserModeList
2015-01-09 17:56 - 2015-01-09 17:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-09 17:55 - 2015-01-09 17:56 - 02347384 _____ (ESET) C:\Users\Jörg\Downloads\esetsmartinstaller_deu.exe
2015-01-09 17:51 - 2015-01-09 17:51 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107.exe
2015-01-09 17:49 - 2015-01-09 17:49 - 00000000 ____D () C:\Windows\ERUNT
2015-01-09 17:48 - 2015-01-09 17:48 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT.exe
2015-01-09 17:38 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 17:36 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Dropbox
2015-01-09 17:35 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150109-173535.backup
2015-01-09 16:24 - 2015-01-09 17:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-09 16:24 - 2015-01-09 16:35 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2015-01-09 16:24 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-09 14:38 - 2015-01-09 14:38 - 00250657 _____ () C:\ProgramData\1420809997.bdinstall.bin
2015-01-07 16:44 - 2015-01-07 16:44 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TrojanHunter
2015-01-07 15:27 - 2015-01-09 16:27 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2015-01-07 15:27 - 2015-01-07 15:27 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2015-01-06 10:26 - 2015-01-06 10:26 - 00292776 _____ () C:\Windows\Minidump\010615-13197-01.dmp
2015-01-05 18:18 - 2015-01-10 13:06 - 00000000 ____D () C:\AdwCleaner
2015-01-04 23:45 - 2015-01-04 23:45 - 00000000 ____D () C:\Users\Jörg\Documents\Klei
2015-01-04 01:33 - 2015-01-04 01:33 - 00002212 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2015-01-04 01:33 - 2015-01-04 01:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2015-01-01 21:52 - 2015-01-02 12:26 - 00000000 ____D () C:\Users\Jörg\Documents\gg
2015-01-01 08:08 - 2015-01-10 20:42 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier
2014-12-31 17:29 - 2015-01-02 02:40 - 00000000 ____D () C:\Program Files\Recuva
2014-12-31 17:29 - 2014-12-31 17:29 - 00001658 _____ () C:\Users\Public\Desktop\Recuva.lnk
2014-12-31 17:17 - 2014-12-31 17:20 - 00000000 ____D () C:\SeaTemp
2014-12-30 23:05 - 2014-12-30 23:05 - 00007236 _____ () C:\Users\Jörg\Documents\poxxparty.xspf
2014-12-30 22:29 - 2014-12-31 17:14 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner
2014-12-30 21:35 - 2015-01-09 17:21 - 00000000 ____D () C:\Users\Jörg\Documents\festlatte
2014-12-27 13:34 - 2014-12-27 13:34 - 00296888 _____ () C:\Windows\Minidump\122714-12230-01.dmp
2014-12-26 22:43 - 2014-12-26 22:43 - 00000000 ____D () C:\Users\Jörg\Documents\BB FlashBack Express 5 Updates
2014-12-26 22:33 - 2014-12-26 22:33 - 00296856 _____ () C:\Windows\Minidump\122614-14352-01.dmp
2014-12-26 19:37 - 2014-12-26 19:37 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-12-26 19:24 - 2014-12-26 19:39 - 00000408 _____ () C:\Windows\system32\checkdnsid.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00540145 _____ () C:\ProgramData\1419616801.bdinstall.bin
2014-12-26 19:05 - 2014-12-26 19:05 - 00000385 _____ () C:\Windows\system32\user_gensett.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____D () C:\ProgramData\BDLogging
2014-12-26 19:05 - 2013-11-04 16:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-12-26 19:05 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2014-12-26 19:05 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2014-12-26 19:00 - 2015-01-09 14:39 - 00000000 ____D () C:\Program Files\Bitdefender
2014-12-26 19:00 - 2014-12-26 19:36 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll
2014-12-26 19:00 - 2014-12-26 19:35 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll
2014-12-26 01:04 - 2015-01-09 14:37 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-12-25 23:51 - 2014-12-25 23:51 - 00001173 _____ () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00001121 _____ () C:\Users\Jörg\Desktop\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\FreeFLVConverter
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter
2014-12-25 23:51 - 2014-10-14 11:00 - 00397312 _____ () C:\Windows\SysWOW64\TubeFinder.exe
2014-12-25 23:51 - 2011-09-22 11:05 - 01081616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2014-12-25 23:51 - 2011-09-22 11:05 - 00152848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2014-12-25 23:50 - 2014-12-26 01:04 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2014-12-19 13:00 - 2014-12-19 12:04 - 01510216 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-12-04-50.log
2014-12-19 12:27 - 2014-12-19 12:01 - 00616683 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-11-59-05.log
2014-12-19 11:19 - 2014-12-19 11:19 - 00000000 ____D () C:\Users\Jörg\Desktop\screenshots
2014-12-18 09:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 09:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 18:56 - 2014-12-17 18:56 - 00293408 _____ () C:\Windows\Minidump\121714-11138-01.dmp
2014-12-17 18:43 - 2014-12-17 18:43 - 00293384 _____ () C:\Windows\Minidump\121714-11856-01.dmp
2014-12-15 07:22 - 2014-12-15 07:22 - 00293376 _____ () C:\Windows\Minidump\121514-14430-01.dmp
2014-12-12 20:39 - 2014-12-12 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (3)
2014-12-12 09:52 - 2014-12-16 05:13 - 00000000 ____D () C:\Program Files (x86)\BEAF8266-AE64-40A2-BF8D-99F4FB145C26

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 20:45 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-10 20:45 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-10 20:39 - 2014-05-04 22:36 - 01777341 _____ () C:\Windows\WindowsUpdate.log
2015-01-10 20:37 - 2014-05-13 12:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-10 20:37 - 2014-05-05 07:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-10 20:37 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-10 20:37 - 2009-07-14 05:51 - 00030308 _____ () C:\Windows\setupact.log
2015-01-10 20:32 - 2014-05-05 07:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-10 19:37 - 2014-05-13 12:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-10 18:15 - 2014-10-15 23:25 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.EU
2015-01-10 15:17 - 2014-11-26 19:49 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.NET
2015-01-10 13:44 - 2014-05-04 22:36 - 00000000 ____D () C:\Users\Jörg
2015-01-10 13:43 - 2014-12-05 21:17 - 00000682 _____ () C:\Users\Jörg\Desktop\Neues Textdokument.txt
2015-01-10 13:05 - 2014-10-03 13:16 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Skype
2015-01-10 04:41 - 2014-11-28 15:14 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\vlc
2015-01-10 03:06 - 2014-11-26 00:04 - 00000000 ____D () C:\Users\Jörg\Desktop\tN-.]H$!
2015-01-10 02:00 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-10 02:00 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-10 02:00 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-10 00:36 - 2014-05-06 14:12 - 00354276 _____ () C:\Windows\PFRO.log
2015-01-10 00:35 - 2014-05-05 07:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-10 00:35 - 2014-05-05 07:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-10 00:35 - 2014-05-05 07:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-10 00:34 - 2014-05-05 07:57 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 00:31 - 2014-05-13 12:24 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Adobe
2015-01-10 00:28 - 2014-10-03 12:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 17:59 - 2014-11-25 04:59 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Macro Toolworks
2015-01-09 17:58 - 2014-05-13 12:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-09 14:00 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-09 03:12 - 2014-11-28 04:26 - 00000000 ____D () C:\Users\Jörg\dwhelper
2015-01-07 15:28 - 2014-10-03 12:11 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-07 15:23 - 2014-10-24 22:20 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TS3Client
2015-01-06 10:26 - 2014-05-13 14:08 - 00000000 ____D () C:\Windows\Minidump
2015-01-06 10:26 - 2014-05-13 14:07 - 648425529 _____ () C:\Windows\MEMORY.DMP
2015-01-06 04:36 - 2014-05-05 07:49 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 18:18 - 2014-12-06 20:03 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\QuickScan
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ____D () C:\ProgramData\Skype
2015-01-04 19:56 - 2014-11-26 19:48 - 00000000 ____D () C:\Program Files (x86)\PokerStars.NET
2015-01-04 03:08 - 2014-10-08 19:25 - 00000000 ____D () C:\Users\Jörg\Documents\my games
2015-01-04 01:33 - 2014-05-13 12:27 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Google
2015-01-03 16:09 - 2014-10-15 23:25 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-12-31 16:58 - 2014-11-26 00:08 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Blueberry
2014-12-26 22:48 - 2014-11-26 00:08 - 00001420 _____ () C:\Users\Public\Desktop\BB FlashBack Express Recorder.lnk
2014-12-26 22:48 - 2014-11-26 00:08 - 00001410 _____ () C:\Users\Public\Desktop\BB FlashBack Express Player.lnk
2014-12-19 14:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\Jörg\AppData\Local\Temp\avgnt.exe
C:\Users\Jörg\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmhvce.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 11:12

==================== End Of Log ============================
         

--- --- ---


Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by Jörg at 2015-01-10 20:45:38
Running from C:\Users\Jörg\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET NOD32 Antivirus 8.0 (Disabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: ESET NOD32 Antivirus 8.0 (Disabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4K Video Downloader 3.4 (HKLM-x32\...\4K Video Downloader_is1) (Version: 3.4.5.1525 - Open Media LLC)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
BB FlashBack Express 5 (HKLM-x32\...\BB FlashBack Express 5) (Version: 5.4.0.3442 - Blueberry)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version:  - Klei Entertainment)
Dropbox (HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\Dropbox) (Version: 3.0.4 - Dropbox, Inc.)
ESET NOD32 Antivirus (HKLM\...\{9EEE5827-F6A6-447E-9839-6AFAF6FCC442}) (Version: 8.0.304.4 - ESET, spol s r. o.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Free FLV Converter V 7.6.2 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.6.2.0 - Koyote Lab Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
KeyCommander 1.3.1 (HKLM-x32\...\KeyCommander) (Version: 1.3.1 - fabi.me)
Life is Feudal: Your Own (HKLM-x32\...\Steam App 290080) (Version:  - Bitbox Ltd.)
ManyCam 3.1.51 (HKLM-x32\...\ManyCam) (Version: 3.1.51 - ManyCam LLC)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Poker at bet365 (HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\...\bet365poker) (Version:  - )
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
PokerStars.net (HKLM-x32\...\PokerStars.net) (Version:  - PokerStars.net)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Robocraft (HKLM-x32\...\Steam App 301520) (Version:  - Freejam)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Tropico 3 - Steam Special Edition (HKLM-x32\...\Steam App 23490) (Version:  - Haemimont Games)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4201028278-1513335983-2328483318-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

09-01-2015 20:30:41 Geplanter Prüfpunkt
09-01-2015 20:37:21 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C0B8D8E-4DBA-4C29-B337-E8253D7988D1} - System32\Tasks\{CD82DDA7-9231-4C19-9908-079D065BCB1C} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller"
Task: {16469745-C0E4-45C4-A525-E29BDD6363EB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {28BBB617-5305-408E-91DB-BB51A0009ECA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {4CB1FE30-CCF6-4C5B-A8D3-378E102B0DF4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {5CD30E1C-C4C6-49C6-BAA8-3EF2F5DFE88D} - System32\Tasks\arp_flush => C:\Program Files (x86)\hide.me VPN\FlushArpCache.exe [2014-11-26] ()
Task: {72FCE252-493A-4119-958D-A6101F085469} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {AAFCE020-5809-442D-B013-64BFB80E1590} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E785A859-D3A2-473D-82BD-16882854DCAF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-10] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-05-05 07:51 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-01 08:08 - 2014-12-31 16:27 - 00087208 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
2015-01-01 08:08 - 2014-12-31 18:13 - 39577768 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
2015-01-09 16:24 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-09 16:24 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-09 16:24 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-09 16:24 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-09 16:24 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 01360552 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libglesv2.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 00214184 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libegl.dll
2015-01-01 08:08 - 2014-12-30 11:17 - 00985768 _____ () C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll
2014-12-02 03:24 - 2014-12-02 03:24 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-01-01 18:19 - 2015-01-10 00:35 - 16843952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:B449BECA

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Hide.me => C:\Program Files (x86)\hide.me VPN\Hide.me.exe
MSCONFIG\startupreg: ManyCam => "C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe" /silent
MSCONFIG\startupreg: MurGee.com Auto Keyboard => C:\ProgramData\Auto Keyboard\AutoKeyboard.exe :silent
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

========================= Accounts: ==========================

Administrator (S-1-5-21-4201028278-1513335983-2328483318-500 - Administrator - Disabled)
Gast (S-1-5-21-4201028278-1513335983-2328483318-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4201028278-1513335983-2328483318-1002 - Limited - Enabled)
Jörg (S-1-5-21-4201028278-1513335983-2328483318-1000 - Administrator - Enabled) => C:\Users\Jörg

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/10/2015 08:34:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Revouninstaller.exe, Version 1.9.5.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 15ac

Startzeit: 01d02ce135fc4684

Endzeit: 15

Anwendungspfad: C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe

Berichts-ID:

Error: (01/10/2015 07:19:24 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (01/10/2015 07:19:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/10/2015 05:57:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm sdclt.exe, Version 6.1.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1728

Startzeit: 01d02cf5fdcd4bb4

Endzeit: 2

Anwendungspfad: C:\Windows\System32\sdclt.exe

Berichts-ID:

Error: (01/10/2015 03:23:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm revouninstaller.exe, Version 1.9.5.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 11e8

Startzeit: 01d02cd905ece2b8

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe

Berichts-ID:

Error: (01/10/2015 02:10:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54a48237
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54a48237
Ausnahmecode: 0x4000001f
Fehleroffset: 0x00194df0
ID des fehlerhaften Prozesses: 0x10b0
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3


System errors:
=============
Error: (01/10/2015 08:38:06 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (01/10/2015 08:38:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/10/2015 08:38:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (01/10/2015 05:53:47 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (01/10/2015 05:53:47 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (01/10/2015 05:53:44 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004


Microsoft Office Sessions:
=========================
Error: (01/10/2015 08:34:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Revouninstaller.exe1.9.5.015ac01d02ce135fc468415C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe

Error: (01/10/2015 07:19:24 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"c:\program files (x86)\blueberry software\bb flashback express 5\FlashBackHookProcess32.exe

Error: (01/10/2015 07:19:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe

Error: (01/10/2015 05:57:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: sdclt.exe6.1.7601.17514172801d02cf5fdcd4bb42C:\Windows\System32\sdclt.exe

Error: (01/10/2015 03:23:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: revouninstaller.exe1.9.5.011e801d02cd905ece2b80C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe

Error: (01/10/2015 02:10:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054a48237compatibilitycheck.exe0.0.0.054a482374000001f00194df010b001d02cca041c3755C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe1b5fecff-98ca-11e4-ba21-c860009f9bf1


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
Percentage of memory in use: 15%
Total physical RAM: 16351.14 MB
Available physical RAM: 13773.16 MB
Total Pagefile: 32700.46 MB
Available Pagefile: 29903.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:648.9 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:925.2 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (Speed) (Fixed) (Total:119.14 GB) (Free:119.02 GB) NTFS
Drive h: (UUI) (Removable) (Total:29.8 GB) (Free:6.22 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 107AAA7E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 3CFE83F3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D48BF4AD)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 29.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-10 20:51:09
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD10EZEX-00RKKA0 rev.80.00A80 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\JRG~1\AppData\Local\Temp\kxldypod.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1512] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                        0000000075248791 4 bytes [C2, 04, 00, 00]
.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                             00000000770d1465 2 bytes [0D, 77]
.text    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1512] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                            00000000770d14bb 2 bytes [0D, 77]
.text    ...                                                                                                                                                                                                               * 2
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2808] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                      00000000770d1465 2 bytes [0D, 77]
.text    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2808] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                     00000000770d14bb 2 bytes [0D, 77]
.text    ...                                                                                                                                                                                                               * 2
---- Processes - GMER 2.1 ----

Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [2504](2015-01-01 07:08:45)  0000000000400000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [1732](2015-01-01 07:08:45)        0000000000f10000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [384](2015-01-01 07:08:45)         0000000000f10000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [1236](2015-01-01 07:08:45)        0000000000f10000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [2612](2015-01-01 07:08:45)        0000000000f10000
Process  C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe (*** suspicious ***) @ C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe [1120](2015-01-01 07:08:45)        0000000000f10000

---- EOF - GMER 2.1 ----
         

Tausend Dank für deine Mühen

Dann jetzt bitt weiter wie oben beschrieben mit TDSSKiller und MBAR

MBAR:

Malwarebytes Anti-Rootkit BETA 1.08.2.1001
www.malwarebytes.org

Database version: v2015.01.10.17

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17501
Jörg :: JÖRG-PC [administrator]

10.01.2015 23:06:42
mbar-log-2015-01-10 (23-06-42).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 325400
Time elapsed: 6 minute(s), 

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

TDSSKiller:

23:29:03.0839 0x09ec  TDSS rootkit removing tool 3.0.0.42 Dec 12 2014 00:35:20
23:29:15.0350 0x09ec  ============================================================
23:29:15.0350 0x09ec  Current date / time: 2015/01/10 23:29:15.0350
23:29:15.0350 0x09ec  SystemInfo:
23:29:15.0350 0x09ec  
23:29:15.0350 0x09ec  OS Version: 6.1.7601 ServicePack: 1.0
23:29:15.0350 0x09ec  Product type: Workstation
23:29:15.0350 0x09ec  ComputerName: JÖRG-PC
23:29:15.0351 0x09ec  UserName: Jörg
23:29:15.0351 0x09ec  Windows directory: C:\Windows
23:29:15.0351 0x09ec  System windows directory: C:\Windows
23:29:15.0351 0x09ec  Running under WOW64
23:29:15.0351 0x09ec  Processor architecture: Intel x64
23:29:15.0351 0x09ec  Number of processors: 4
23:29:15.0351 0x09ec  Page size: 0x1000
23:29:15.0351 0x09ec  Boot type: Normal boot
23:29:15.0351 0x09ec  ============================================================
23:29:16.0549 0x09ec  KLMD registered as C:\Windows\system32\drivers\72409231.sys
23:29:16.0670 0x09ec  System UUID: {23E5507D-D7AA-E704-1DD8-BADC6B6352EA}
23:29:16.0893 0x09ec  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:29:17.0119 0x09ec  Drive \Device\Harddisk1\DR1 - Size: 0x1DCF856000 ( 119.24 Gb ), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:29:17.0138 0x09ec  Drive \Device\Harddisk2\DR2 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:29:17.0142 0x09ec  Drive \Device\Harddisk3\DR3 - Size: 0x774488000 ( 29.82 Gb ), SectorSize: 0x200, Cylinders: 0xF34, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
23:29:17.0144 0x09ec  ============================================================
23:29:17.0144 0x09ec  \Device\Harddisk0\DR0:
23:29:17.0144 0x09ec  MBR partitions:
23:29:17.0144 0x09ec  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
23:29:17.0144 0x09ec  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
23:29:17.0144 0x09ec  \Device\Harddisk1\DR1:
23:29:17.0144 0x09ec  MBR partitions:
23:29:17.0145 0x09ec  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
23:29:17.0145 0x09ec  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xEE49000
23:29:17.0145 0x09ec  \Device\Harddisk2\DR2:
23:29:17.0145 0x09ec  MBR partitions:
23:29:17.0145 0x09ec  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
23:29:17.0145 0x09ec  \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
23:29:17.0145 0x09ec  \Device\Harddisk3\DR3:
23:29:17.0145 0x09ec  MBR partitions:
23:29:17.0146 0x09ec  \Device\Harddisk3\DR3\Partition1: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3BA2420
23:29:17.0146 0x09ec  ============================================================
23:29:17.0171 0x09ec  C: <-> \Device\Harddisk2\DR2\Partition2
23:29:17.0172 0x09ec  D: <-> \Device\Harddisk0\DR0\Partition1
23:29:17.0173 0x09ec  E: <-> \Device\Harddisk0\DR0\Partition2
23:29:17.0174 0x09ec  F: <-> \Device\Harddisk1\DR1\Partition1
23:29:17.0175 0x09ec  G: <-> \Device\Harddisk1\DR1\Partition2
23:29:17.0175 0x09ec  ============================================================
23:29:17.0175 0x09ec  Initialize success
23:29:17.0175 0x09ec  ============================================================
23:29:24.0057 0x01b0  ============================================================
23:29:24.0057 0x01b0  Scan started
23:29:24.0057 0x01b0  Mode: Manual; 
23:29:24.0057 0x01b0  ============================================================
23:29:24.0057 0x01b0  KSN ping started
23:29:37.0789 0x01b0  KSN ping finished: true
23:29:38.0531 0x01b0  ================ Scan system memory ========================
23:29:38.0531 0x01b0  System memory - ok
23:29:38.0531 0x01b0  ================ Scan services =============================
23:29:38.0639 0x01b0  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
23:29:38.0646 0x01b0  1394ohci - ok
23:29:38.0678 0x01b0  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
23:29:38.0682 0x01b0  ACPI - ok
23:29:38.0704 0x01b0  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
23:29:38.0704 0x01b0  AcpiPmi - ok
23:29:38.0794 0x01b0  [ 4C72FDD915D62EAEF149BD9C73AB9CF4, 8EA45A1B88DFD819F0ADA3AF36D464E1BF52574269592370E0CC8D0490680E1F ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
23:29:38.0797 0x01b0  AdobeARMservice - ok
23:29:38.0868 0x01b0  [ 4E48A7DF7ECACB38C686B2BEBAA687A3, D4DEE6BD464855B24A6D40BC6A9279B2041099615C6A319D869DA113AD896EA3 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
23:29:38.0876 0x01b0  AdobeFlashPlayerUpdateSvc - ok
23:29:38.0907 0x01b0  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
23:29:38.0917 0x01b0  adp94xx - ok
23:29:38.0940 0x01b0  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
23:29:38.0947 0x01b0  adpahci - ok
23:29:38.0971 0x01b0  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
23:29:38.0976 0x01b0  adpu320 - ok
23:29:38.0999 0x01b0  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
23:29:39.0001 0x01b0  AeLookupSvc - ok
23:29:39.0045 0x01b0  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
23:29:39.0060 0x01b0  AFD - ok
23:29:39.0069 0x01b0  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
23:29:39.0071 0x01b0  agp440 - ok
23:29:39.0084 0x01b0  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
23:29:39.0085 0x01b0  ALG - ok
23:29:39.0098 0x01b0  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
23:29:39.0099 0x01b0  aliide - ok
23:29:39.0103 0x01b0  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
23:29:39.0104 0x01b0  amdide - ok
23:29:39.0109 0x01b0  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
23:29:39.0111 0x01b0  AmdK8 - ok
23:29:39.0137 0x01b0  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
23:29:39.0139 0x01b0  AmdPPM - ok
23:29:39.0146 0x01b0  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
23:29:39.0150 0x01b0  amdsata - ok
23:29:39.0178 0x01b0  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
23:29:39.0182 0x01b0  amdsbs - ok
23:29:39.0196 0x01b0  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
23:29:39.0197 0x01b0  amdxata - ok
23:29:39.0220 0x01b0  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
23:29:39.0222 0x01b0  AppID - ok
23:29:39.0234 0x01b0  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
23:29:39.0236 0x01b0  AppIDSvc - ok
23:29:39.0261 0x01b0  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
23:29:39.0263 0x01b0  Appinfo - ok
23:29:39.0274 0x01b0  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
23:29:39.0276 0x01b0  arc - ok
23:29:39.0281 0x01b0  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
23:29:39.0283 0x01b0  arcsas - ok
23:29:39.0303 0x01b0  [ 08E2D77766CC05E75A0707207D9FC684, 6CF3B12B2B3375B715A3EBC66EF148CEA2248D448A3A37875B7B1BC7CDA40FDD ] asmtxhci        C:\Windows\system32\DRIVERS\asmtxhci.sys
23:29:39.0311 0x01b0  asmtxhci - ok
23:29:39.0375 0x01b0  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
23:29:39.0387 0x01b0  aspnet_state - ok
23:29:39.0411 0x01b0  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
23:29:39.0412 0x01b0  AsyncMac - ok
23:29:39.0427 0x01b0  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
23:29:39.0429 0x01b0  atapi - ok
23:29:39.0462 0x01b0  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
23:29:39.0481 0x01b0  AudioEndpointBuilder - ok
23:29:39.0545 0x01b0  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioSrv        C:\Windows\System32\Audiosrv.dll
23:29:39.0563 0x01b0  AudioSrv - ok
23:29:39.0587 0x01b0  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
23:29:39.0588 0x01b0  AxInstSV - ok
23:29:39.0607 0x01b0  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
23:29:39.0613 0x01b0  b06bdrv - ok
23:29:39.0626 0x01b0  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
23:29:39.0629 0x01b0  b57nd60a - ok
23:29:39.0644 0x01b0  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
23:29:39.0646 0x01b0  BDESVC - ok
23:29:39.0657 0x01b0  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
23:29:39.0657 0x01b0  Beep - ok
23:29:39.0717 0x01b0  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
23:29:39.0726 0x01b0  BFE - ok
23:29:39.0767 0x01b0  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
23:29:39.0777 0x01b0  BITS - ok
23:29:39.0795 0x01b0  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
23:29:39.0796 0x01b0  blbdrive - ok
23:29:39.0812 0x01b0  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
23:29:39.0815 0x01b0  bowser - ok
23:29:39.0823 0x01b0  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
23:29:39.0824 0x01b0  BrFiltLo - ok
23:29:39.0828 0x01b0  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
23:29:39.0829 0x01b0  BrFiltUp - ok
23:29:39.0853 0x01b0  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
23:29:39.0858 0x01b0  Browser - ok
23:29:39.0875 0x01b0  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
23:29:39.0882 0x01b0  Brserid - ok
23:29:39.0895 0x01b0  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
23:29:39.0897 0x01b0  BrSerWdm - ok
23:29:39.0900 0x01b0  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
23:29:39.0901 0x01b0  BrUsbMdm - ok
23:29:39.0904 0x01b0  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
23:29:39.0905 0x01b0  BrUsbSer - ok
23:29:39.0910 0x01b0  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
23:29:39.0912 0x01b0  BTHMODEM - ok
23:29:39.0926 0x01b0  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
23:29:39.0928 0x01b0  bthserv - ok
23:29:39.0940 0x01b0  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
23:29:39.0943 0x01b0  cdfs - ok
23:29:39.0969 0x01b0  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\drivers\cdrom.sys
23:29:39.0973 0x01b0  cdrom - ok
23:29:40.0001 0x01b0  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
23:29:40.0004 0x01b0  CertPropSvc - ok
23:29:40.0013 0x01b0  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
23:29:40.0015 0x01b0  circlass - ok
23:29:40.0036 0x01b0  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
23:29:40.0045 0x01b0  CLFS - ok
23:29:40.0089 0x01b0  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:29:40.0091 0x01b0  clr_optimization_v2.0.50727_32 - ok
23:29:40.0132 0x01b0  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
23:29:40.0136 0x01b0  clr_optimization_v2.0.50727_64 - ok
23:29:40.0179 0x01b0  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:29:40.0180 0x01b0  clr_optimization_v4.0.30319_32 - ok
23:29:40.0199 0x01b0  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
23:29:40.0215 0x01b0  clr_optimization_v4.0.30319_64 - ok
23:29:40.0231 0x01b0  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
23:29:40.0231 0x01b0  CmBatt - ok
23:29:40.0240 0x01b0  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
23:29:40.0241 0x01b0  cmdide - ok
23:29:40.0279 0x01b0  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
23:29:40.0291 0x01b0  CNG - ok
23:29:40.0303 0x01b0  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
23:29:40.0304 0x01b0  Compbatt - ok
23:29:40.0321 0x01b0  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
23:29:40.0323 0x01b0  CompositeBus - ok
23:29:40.0326 0x01b0  COMSysApp - ok
23:29:40.0332 0x01b0  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
23:29:40.0333 0x01b0  crcdisk - ok
23:29:40.0357 0x01b0  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
23:29:40.0360 0x01b0  CryptSvc - ok
23:29:40.0398 0x01b0  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
23:29:40.0411 0x01b0  DcomLaunch - ok
23:29:40.0426 0x01b0  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
23:29:40.0430 0x01b0  defragsvc - ok
23:29:40.0446 0x01b0  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
23:29:40.0448 0x01b0  DfsC - ok
23:29:40.0483 0x01b0  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
23:29:40.0493 0x01b0  Dhcp - ok
23:29:40.0514 0x01b0  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
23:29:40.0515 0x01b0  discache - ok
23:29:40.0527 0x01b0  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
23:29:40.0528 0x01b0  Disk - ok
23:29:40.0543 0x01b0  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
23:29:40.0545 0x01b0  Dnscache - ok
23:29:40.0564 0x01b0  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
23:29:40.0568 0x01b0  dot3svc - ok
23:29:40.0591 0x01b0  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
23:29:40.0593 0x01b0  DPS - ok
23:29:40.0626 0x01b0  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
23:29:40.0627 0x01b0  drmkaud - ok
23:29:40.0677 0x01b0  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
23:29:40.0690 0x01b0  DXGKrnl - ok
23:29:40.0717 0x01b0  [ D47E023B543D9FA72EBAAD4D30E499B3, 7045060D418B1EE1499336A973C334869330843F3ADE5420D93B64A1BDAB2DA8 ] eamonm          C:\Windows\system32\DRIVERS\eamonm.sys
23:29:40.0720 0x01b0  eamonm - ok
23:29:40.0730 0x01b0  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
23:29:40.0732 0x01b0  EapHost - ok
23:29:40.0792 0x01b0  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
23:29:40.0828 0x01b0  ebdrv - ok
23:29:40.0857 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
23:29:40.0858 0x01b0  EFS - ok
23:29:40.0892 0x01b0  [ EDE769200779A9746A0F1425EBEE59FE, 001DAE9569FCA7CD5A97B8F74940ADCD084DADD2F69F1002765F424B10D30B97 ] ehdrv           C:\Windows\system32\DRIVERS\ehdrv.sys
23:29:40.0897 0x01b0  ehdrv - ok
23:29:40.0951 0x01b0  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
23:29:40.0971 0x01b0  ehRecvr - ok
23:29:40.0995 0x01b0  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
23:29:40.0997 0x01b0  ehSched - ok
23:29:41.0120 0x01b0  [ 58FBDA10FC403CF9F82ABD0A68129BA3, D731021C2A94A31CD944E95628AC2DFFF0D555659BF0DF6FC57676B8B88355A4 ] ekrn            C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
23:29:41.0140 0x01b0  ekrn - ok
23:29:41.0205 0x01b0  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
23:29:41.0220 0x01b0  elxstor - ok
23:29:41.0239 0x01b0  [ 5FBD015FAEDAA6E3FF76F95112DD6554, 253CB6BB55820C8CD3DABB1DB68A1982C6838028A679C3507140BC8D9CB0AD73 ] epfwwfpr        C:\Windows\system32\DRIVERS\epfwwfpr.sys
23:29:41.0241 0x01b0  epfwwfpr - ok
23:29:41.0265 0x01b0  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
23:29:41.0266 0x01b0  ErrDev - ok
23:29:41.0287 0x01b0  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
23:29:41.0300 0x01b0  EventSystem - ok
23:29:41.0327 0x01b0  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
23:29:41.0333 0x01b0  exfat - ok
23:29:41.0349 0x01b0  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
23:29:41.0355 0x01b0  fastfat - ok
23:29:41.0407 0x01b0  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
23:29:41.0427 0x01b0  Fax - ok
23:29:41.0439 0x01b0  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
23:29:41.0440 0x01b0  fdc - ok
23:29:41.0447 0x01b0  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
23:29:41.0448 0x01b0  fdPHost - ok
23:29:41.0459 0x01b0  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
23:29:41.0460 0x01b0  FDResPub - ok
23:29:41.0467 0x01b0  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
23:29:41.0468 0x01b0  FileInfo - ok
23:29:41.0479 0x01b0  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
23:29:41.0480 0x01b0  Filetrace - ok
23:29:41.0491 0x01b0  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
23:29:41.0492 0x01b0  flpydisk - ok
23:29:41.0517 0x01b0  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
23:29:41.0520 0x01b0  FltMgr - ok
23:29:41.0581 0x01b0  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
23:29:41.0594 0x01b0  FontCache - ok
23:29:41.0632 0x01b0  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
23:29:41.0633 0x01b0  FontCache3.0.0.0 - ok
23:29:41.0644 0x01b0  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
23:29:41.0647 0x01b0  FsDepends - ok
23:29:41.0667 0x01b0  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
23:29:41.0668 0x01b0  Fs_Rec - ok
23:29:41.0688 0x01b0  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
23:29:41.0690 0x01b0  fvevol - ok
23:29:41.0706 0x01b0  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
23:29:41.0708 0x01b0  gagp30kx - ok
23:29:41.0753 0x01b0  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
23:29:41.0766 0x01b0  gpsvc - ok
23:29:41.0814 0x01b0  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:29:41.0816 0x01b0  gupdate - ok
23:29:41.0819 0x01b0  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:29:41.0820 0x01b0  gupdatem - ok
23:29:41.0833 0x01b0  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
23:29:41.0834 0x01b0  hcw85cir - ok
23:29:41.0858 0x01b0  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
23:29:41.0862 0x01b0  HdAudAddService - ok
23:29:41.0875 0x01b0  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
23:29:41.0877 0x01b0  HDAudBus - ok
23:29:41.0886 0x01b0  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
23:29:41.0887 0x01b0  HidBatt - ok
23:29:41.0895 0x01b0  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
23:29:41.0896 0x01b0  HidBth - ok
23:29:41.0907 0x01b0  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
23:29:41.0908 0x01b0  HidIr - ok
23:29:41.0916 0x01b0  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
23:29:41.0917 0x01b0  hidserv - ok
23:29:41.0941 0x01b0  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
23:29:41.0942 0x01b0  HidUsb - ok
23:29:41.0970 0x01b0  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
23:29:41.0972 0x01b0  hkmsvc - ok
23:29:41.0999 0x01b0  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
23:29:42.0003 0x01b0  HomeGroupListener - ok
23:29:42.0017 0x01b0  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
23:29:42.0021 0x01b0  HomeGroupProvider - ok
23:29:42.0035 0x01b0  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
23:29:42.0037 0x01b0  HpSAMD - ok
23:29:42.0073 0x01b0  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
23:29:42.0084 0x01b0  HTTP - ok
23:29:42.0119 0x01b0  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
23:29:42.0120 0x01b0  hwpolicy - ok
23:29:42.0143 0x01b0  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
23:29:42.0145 0x01b0  i8042prt - ok
23:29:42.0160 0x01b0  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
23:29:42.0165 0x01b0  iaStorV - ok
23:29:42.0203 0x01b0  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
23:29:42.0213 0x01b0  idsvc - ok
23:29:42.0215 0x01b0  IEEtwCollectorService - ok
23:29:42.0230 0x01b0  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
23:29:42.0231 0x01b0  iirsp - ok
23:29:42.0270 0x01b0  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
23:29:42.0280 0x01b0  IKEEXT - ok
23:29:42.0294 0x01b0  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
23:29:42.0294 0x01b0  intelide - ok
23:29:42.0303 0x01b0  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
23:29:42.0304 0x01b0  intelppm - ok
23:29:42.0315 0x01b0  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
23:29:42.0316 0x01b0  IPBusEnum - ok
23:29:42.0339 0x01b0  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:29:42.0340 0x01b0  IpFilterDriver - ok
23:29:42.0380 0x01b0  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
23:29:42.0394 0x01b0  iphlpsvc - ok
23:29:42.0399 0x01b0  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
23:29:42.0401 0x01b0  IPMIDRV - ok
23:29:42.0411 0x01b0  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
23:29:42.0414 0x01b0  IPNAT - ok
23:29:42.0422 0x01b0  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
23:29:42.0423 0x01b0  IRENUM - ok
23:29:42.0452 0x01b0  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
23:29:42.0453 0x01b0  isapnp - ok
23:29:42.0473 0x01b0  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
23:29:42.0478 0x01b0  iScsiPrt - ok
23:29:42.0487 0x01b0  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
23:29:42.0489 0x01b0  kbdclass - ok
23:29:42.0497 0x01b0  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
23:29:42.0498 0x01b0  kbdhid - ok
23:29:42.0516 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
23:29:42.0517 0x01b0  KeyIso - ok
23:29:42.0530 0x01b0  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
23:29:42.0532 0x01b0  KSecDD - ok
23:29:42.0553 0x01b0  [ 41774FF331F609EF442B7398EE6202B1, AD67DA06A74895C384F4A1F1CF47050DAEE9C6CE8AD12F1A116FC977B6C3A864 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
23:29:42.0556 0x01b0  KSecPkg - ok
23:29:42.0574 0x01b0  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
23:29:42.0575 0x01b0  ksthunk - ok
23:29:42.0599 0x01b0  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
23:29:42.0606 0x01b0  KtmRm - ok
23:29:42.0627 0x01b0  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
23:29:42.0632 0x01b0  LanmanServer - ok
23:29:42.0644 0x01b0  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
23:29:42.0648 0x01b0  LanmanWorkstation - ok
23:29:42.0667 0x01b0  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
23:29:42.0668 0x01b0  lltdio - ok
23:29:42.0700 0x01b0  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
23:29:42.0710 0x01b0  lltdsvc - ok
23:29:42.0729 0x01b0  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
23:29:42.0731 0x01b0  lmhosts - ok
23:29:42.0745 0x01b0  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
23:29:42.0749 0x01b0  LSI_FC - ok
23:29:42.0758 0x01b0  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
23:29:42.0760 0x01b0  LSI_SAS - ok
23:29:42.0774 0x01b0  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
23:29:42.0776 0x01b0  LSI_SAS2 - ok
23:29:42.0784 0x01b0  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
23:29:42.0787 0x01b0  LSI_SCSI - ok
23:29:42.0797 0x01b0  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
23:29:42.0800 0x01b0  luafv - ok
23:29:42.0843 0x01b0  [ DE585D1D266805E5EEDAE911FDD16F38, D954C1795D98653F1FB0AE8650FF0DEDDAA730B98C9449E6F608154D573DAB27 ] ManyCam         C:\Windows\system32\DRIVERS\mcvidrv_x64.sys
23:29:42.0845 0x01b0  ManyCam - ok
23:29:42.0872 0x01b0  [ 5858C4ABE87D0A842A941D6BD08038F1, FA082135752ECE107AC5E94066541F07FC1D56CE070CE8476A30375308F290A9 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys
23:29:42.0874 0x01b0  mcaudrv_simple - ok
23:29:42.0895 0x01b0  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
23:29:42.0899 0x01b0  Mcx2Svc - ok
23:29:42.0912 0x01b0  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
23:29:42.0914 0x01b0  megasas - ok
23:29:42.0933 0x01b0  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
23:29:42.0940 0x01b0  MegaSR - ok
23:29:42.0963 0x01b0  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
23:29:42.0965 0x01b0  MEIx64 - ok
23:29:42.0989 0x01b0  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
23:29:42.0992 0x01b0  MMCSS - ok
23:29:43.0007 0x01b0  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
23:29:43.0009 0x01b0  Modem - ok
23:29:43.0025 0x01b0  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
23:29:43.0026 0x01b0  monitor - ok
23:29:43.0038 0x01b0  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
23:29:43.0039 0x01b0  mouclass - ok
23:29:43.0048 0x01b0  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
23:29:43.0050 0x01b0  mouhid - ok
23:29:43.0087 0x01b0  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
23:29:43.0089 0x01b0  mountmgr - ok
23:29:43.0117 0x01b0  [ D1CB0BC1CBA61639FE7162C5476A22C0, 80469683BD18CE0B6E9D9BD3613A63896F3D50A783EFDC15CEA28560C151C6B9 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
23:29:43.0120 0x01b0  MozillaMaintenance - ok
23:29:43.0144 0x01b0  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
23:29:43.0148 0x01b0  mpio - ok
23:29:43.0160 0x01b0  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
23:29:43.0162 0x01b0  mpsdrv - ok
23:29:43.0207 0x01b0  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
23:29:43.0227 0x01b0  MpsSvc - ok
23:29:43.0267 0x01b0  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
23:29:43.0271 0x01b0  MRxDAV - ok
23:29:43.0299 0x01b0  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
23:29:43.0304 0x01b0  mrxsmb - ok
23:29:43.0325 0x01b0  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:29:43.0333 0x01b0  mrxsmb10 - ok
23:29:43.0350 0x01b0  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:29:43.0353 0x01b0  mrxsmb20 - ok
23:29:43.0376 0x01b0  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
23:29:43.0378 0x01b0  msahci - ok
23:29:43.0392 0x01b0  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
23:29:43.0395 0x01b0  msdsm - ok
23:29:43.0405 0x01b0  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
23:29:43.0409 0x01b0  MSDTC - ok
23:29:43.0421 0x01b0  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
23:29:43.0422 0x01b0  Msfs - ok
23:29:43.0433 0x01b0  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
23:29:43.0433 0x01b0  mshidkmdf - ok
23:29:43.0455 0x01b0  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
23:29:43.0456 0x01b0  msisadrv - ok
23:29:43.0480 0x01b0  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
23:29:43.0483 0x01b0  MSiSCSI - ok
23:29:43.0485 0x01b0  msiserver - ok
23:29:43.0493 0x01b0  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
23:29:43.0494 0x01b0  MSKSSRV - ok
23:29:43.0498 0x01b0  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
23:29:43.0499 0x01b0  MSPCLOCK - ok
23:29:43.0512 0x01b0  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
23:29:43.0513 0x01b0  MSPQM - ok
23:29:43.0546 0x01b0  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
23:29:43.0557 0x01b0  MsRPC - ok
23:29:43.0571 0x01b0  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
23:29:43.0573 0x01b0  mssmbios - ok
23:29:43.0575 0x01b0  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
23:29:43.0575 0x01b0  MSTEE - ok
23:29:43.0585 0x01b0  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
23:29:43.0586 0x01b0  MTConfig - ok
23:29:43.0597 0x01b0  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
23:29:43.0599 0x01b0  Mup - ok
23:29:43.0634 0x01b0  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
23:29:43.0649 0x01b0  napagent - ok
23:29:43.0675 0x01b0  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
23:29:43.0682 0x01b0  NativeWifiP - ok
23:29:43.0740 0x01b0  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
23:29:43.0754 0x01b0  NDIS - ok
23:29:43.0766 0x01b0  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
23:29:43.0768 0x01b0  NdisCap - ok
23:29:43.0781 0x01b0  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
23:29:43.0782 0x01b0  NdisTapi - ok
23:29:43.0805 0x01b0  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
23:29:43.0807 0x01b0  Ndisuio - ok
23:29:43.0831 0x01b0  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
23:29:43.0834 0x01b0  NdisWan - ok
23:29:43.0853 0x01b0  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
23:29:43.0854 0x01b0  NDProxy - ok
23:29:43.0864 0x01b0  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
23:29:43.0865 0x01b0  NetBIOS - ok
23:29:43.0889 0x01b0  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
23:29:43.0894 0x01b0  NetBT - ok
23:29:43.0907 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
23:29:43.0909 0x01b0  Netlogon - ok
23:29:43.0926 0x01b0  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
23:29:43.0934 0x01b0  Netman - ok
23:29:43.0963 0x01b0  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:29:43.0965 0x01b0  NetMsmqActivator - ok
23:29:43.0969 0x01b0  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:29:43.0970 0x01b0  NetPipeActivator - ok
23:29:43.0985 0x01b0  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
23:29:43.0991 0x01b0  netprofm - ok
23:29:44.0004 0x01b0  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:29:44.0006 0x01b0  NetTcpActivator - ok
23:29:44.0010 0x01b0  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
23:29:44.0011 0x01b0  NetTcpPortSharing - ok
23:29:44.0030 0x01b0  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
23:29:44.0031 0x01b0  nfrd960 - ok
23:29:44.0063 0x01b0  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
23:29:44.0073 0x01b0  NlaSvc - ok
23:29:44.0088 0x01b0  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
23:29:44.0090 0x01b0  Npfs - ok
23:29:44.0102 0x01b0  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
23:29:44.0104 0x01b0  nsi - ok
23:29:44.0121 0x01b0  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
23:29:44.0123 0x01b0  nsiproxy - ok
23:29:44.0189 0x01b0  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
23:29:44.0221 0x01b0  Ntfs - ok
23:29:44.0235 0x01b0  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
23:29:44.0235 0x01b0  Null - ok
23:29:44.0261 0x01b0  [ E366A5681C50785D4ED04FCFD65C3415, 7FF7B4B8F09E773401AE879897E60BF494B57B9ACEE990204A4C98A3FB183A33 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
23:29:44.0264 0x01b0  NVHDA - ok
23:29:44.0519 0x01b0  [ 2232AE1BB51A96A7381A2CA17DF12E24, 4813E27BC14EB3CBD55AF89B098EA5C8DA4C7FF0B6CCB7AACFC43BC0E578C988 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:29:44.0658 0x01b0  nvlddmkm - ok
23:29:44.0689 0x01b0  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
23:29:44.0691 0x01b0  nvraid - ok
23:29:44.0716 0x01b0  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
23:29:44.0721 0x01b0  nvstor - ok
23:29:44.0770 0x01b0  [ 2C8DD5A34A81715865D66D7AF39362A6, 62F9D873127921EE2EAA80B73E8994C4BF6DA7EEDACAEA030B8D58E086FD3850 ] nvsvc           C:\Windows\system32\nvvsvc.exe
23:29:44.0793 0x01b0  nvsvc - ok
23:29:44.0802 0x01b0  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
23:29:44.0803 0x01b0  nv_agp - ok
23:29:44.0825 0x01b0  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
23:29:44.0826 0x01b0  ohci1394 - ok
23:29:44.0843 0x01b0  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
23:29:44.0847 0x01b0  p2pimsvc - ok
23:29:44.0871 0x01b0  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
23:29:44.0878 0x01b0  p2psvc - ok
23:29:44.0892 0x01b0  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
23:29:44.0894 0x01b0  Parport - ok
23:29:44.0910 0x01b0  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
23:29:44.0911 0x01b0  partmgr - ok
23:29:44.0925 0x01b0  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
23:29:44.0929 0x01b0  PcaSvc - ok
23:29:44.0937 0x01b0  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
23:29:44.0940 0x01b0  pci - ok
23:29:44.0955 0x01b0  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
23:29:44.0955 0x01b0  pciide - ok
23:29:44.0984 0x01b0  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
23:29:44.0991 0x01b0  pcmcia - ok
23:29:45.0002 0x01b0  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
23:29:45.0004 0x01b0  pcw - ok
23:29:45.0028 0x01b0  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
23:29:45.0036 0x01b0  PEAUTH - ok
23:29:45.0084 0x01b0  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
23:29:45.0086 0x01b0  PerfHost - ok
23:29:45.0138 0x01b0  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
23:29:45.0158 0x01b0  pla - ok
23:29:45.0201 0x01b0  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
23:29:45.0206 0x01b0  PlugPlay - ok
23:29:45.0214 0x01b0  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
23:29:45.0216 0x01b0  PNRPAutoReg - ok
23:29:45.0235 0x01b0  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
23:29:45.0239 0x01b0  PNRPsvc - ok
23:29:45.0257 0x01b0  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
23:29:45.0263 0x01b0  PolicyAgent - ok
23:29:45.0295 0x01b0  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
23:29:45.0298 0x01b0  Power - ok
23:29:45.0326 0x01b0  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
23:29:45.0330 0x01b0  PptpMiniport - ok
23:29:45.0342 0x01b0  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
23:29:45.0344 0x01b0  Processor - ok
23:29:45.0367 0x01b0  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
23:29:45.0375 0x01b0  ProfSvc - ok
23:29:45.0383 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
23:29:45.0385 0x01b0  ProtectedStorage - ok
23:29:45.0421 0x01b0  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
23:29:45.0426 0x01b0  Psched - ok
23:29:45.0479 0x01b0  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
23:29:45.0496 0x01b0  ql2300 - ok
23:29:45.0513 0x01b0  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
23:29:45.0515 0x01b0  ql40xx - ok
23:29:45.0532 0x01b0  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
23:29:45.0535 0x01b0  QWAVE - ok
23:29:45.0545 0x01b0  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
23:29:45.0546 0x01b0  QWAVEdrv - ok
23:29:45.0556 0x01b0  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
23:29:45.0556 0x01b0  RasAcd - ok
23:29:45.0571 0x01b0  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
23:29:45.0572 0x01b0  RasAgileVpn - ok
23:29:45.0580 0x01b0  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
23:29:45.0582 0x01b0  RasAuto - ok
23:29:45.0595 0x01b0  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
23:29:45.0597 0x01b0  Rasl2tp - ok
23:29:45.0633 0x01b0  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
23:29:45.0645 0x01b0  RasMan - ok
23:29:45.0670 0x01b0  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
23:29:45.0674 0x01b0  RasPppoe - ok
23:29:45.0684 0x01b0  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
23:29:45.0687 0x01b0  RasSstp - ok
23:29:45.0710 0x01b0  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
23:29:45.0720 0x01b0  rdbss - ok
23:29:45.0739 0x01b0  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
23:29:45.0740 0x01b0  rdpbus - ok
23:29:45.0751 0x01b0  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
23:29:45.0752 0x01b0  RDPCDD - ok
23:29:45.0756 0x01b0  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
23:29:45.0757 0x01b0  RDPENCDD - ok
23:29:45.0763 0x01b0  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
23:29:45.0764 0x01b0  RDPREFMP - ok
23:29:45.0784 0x01b0  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
23:29:45.0788 0x01b0  RDPWD - ok
23:29:45.0814 0x01b0  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
23:29:45.0819 0x01b0  rdyboost - ok
23:29:45.0839 0x01b0  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
23:29:45.0842 0x01b0  RemoteAccess - ok
23:29:45.0854 0x01b0  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
23:29:45.0858 0x01b0  RemoteRegistry - ok
23:29:45.0871 0x01b0  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
23:29:45.0873 0x01b0  RpcEptMapper - ok
23:29:45.0900 0x01b0  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
23:29:45.0901 0x01b0  RpcLocator - ok
23:29:45.0939 0x01b0  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
23:29:45.0956 0x01b0  RpcSs - ok
23:29:45.0973 0x01b0  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
23:29:45.0974 0x01b0  rspndr - ok
23:29:46.0017 0x01b0  [ 7F4F11527AF5A7E4526CB6A146B3E40C, 705177014374AB2F12AF4558344C35C206C2820BD1A16770173EA10D094D182B ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
23:29:46.0026 0x01b0  RTL8167 - ok
23:29:46.0028 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
23:29:46.0029 0x01b0  SamSs - ok
23:29:46.0048 0x01b0  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
23:29:46.0049 0x01b0  sbp2port - ok
23:29:46.0062 0x01b0  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
23:29:46.0065 0x01b0  SCardSvr - ok
23:29:46.0089 0x01b0  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
23:29:46.0090 0x01b0  scfilter - ok
23:29:46.0143 0x01b0  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
23:29:46.0157 0x01b0  Schedule - ok
23:29:46.0183 0x01b0  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
23:29:46.0184 0x01b0  SCPolicySvc - ok
23:29:46.0211 0x01b0  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
23:29:46.0214 0x01b0  SDRSVC - ok
23:29:46.0330 0x01b0  [ D777F1417D9BB9F66CD9D9C3B61F730F, 0CBD830EB9D2B0F1946131F20907793B2D68A3BCEEC3EA5416972149F73DC815 ] SDScannerService C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
23:29:46.0349 0x01b0  SDScannerService - ok
23:29:46.0391 0x01b0  [ 68D6C7F99BC73B88954D844FCCBEB2A0, F746861B103C8BE8EA234B9FCFBBDD2412C79FB65F2F1E0F5E6EBC0B34905FF1 ] SDUpdateService C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
23:29:46.0414 0x01b0  SDUpdateService - ok
23:29:46.0427 0x01b0  [ 9B9B368A8FF5CAF91D7A333CF62CD2CC, A4AE7FFBBAF983BFDE15B521ED162CBC4E6FC85BCDB200C75D45878B3FFDFA68 ] SDWSCService    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
23:29:46.0429 0x01b0  SDWSCService - ok
23:29:46.0439 0x01b0  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
23:29:46.0440 0x01b0  secdrv - ok
23:29:46.0463 0x01b0  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
23:29:46.0464 0x01b0  seclogon - ok
23:29:46.0475 0x01b0  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
23:29:46.0479 0x01b0  SENS - ok
23:29:46.0490 0x01b0  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
23:29:46.0493 0x01b0  SensrSvc - ok
23:29:46.0516 0x01b0  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
23:29:46.0518 0x01b0  Serenum - ok
23:29:46.0547 0x01b0  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
23:29:46.0550 0x01b0  Serial - ok
23:29:46.0579 0x01b0  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
23:29:46.0580 0x01b0  sermouse - ok
23:29:46.0610 0x01b0  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
23:29:46.0614 0x01b0  SessionEnv - ok
23:29:46.0634 0x01b0  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
23:29:46.0635 0x01b0  sffdisk - ok
23:29:46.0648 0x01b0  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
23:29:46.0649 0x01b0  sffp_mmc - ok
23:29:46.0655 0x01b0  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
23:29:46.0656 0x01b0  sffp_sd - ok
23:29:46.0666 0x01b0  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
23:29:46.0667 0x01b0  sfloppy - ok
23:29:46.0688 0x01b0  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
23:29:46.0696 0x01b0  SharedAccess - ok
23:29:46.0723 0x01b0  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
23:29:46.0731 0x01b0  ShellHWDetection - ok
23:29:46.0753 0x01b0  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
23:29:46.0754 0x01b0  SiSRaid2 - ok
23:29:46.0767 0x01b0  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
23:29:46.0769 0x01b0  SiSRaid4 - ok
23:29:46.0800 0x01b0  [ F6EF225A23D336CA30001E5007644C24, B0A4B1256C1074F1B4F73E3BBA16FD4683D6EEA583DEEF8E11EFD29BA7541F2A ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
23:29:46.0806 0x01b0  SkypeUpdate - ok
23:29:46.0822 0x01b0  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
23:29:46.0824 0x01b0  Smb - ok
23:29:46.0844 0x01b0  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
23:29:46.0846 0x01b0  SNMPTRAP - ok
23:29:46.0856 0x01b0  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
23:29:46.0857 0x01b0  spldr - ok
23:29:46.0903 0x01b0  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
23:29:46.0920 0x01b0  Spooler - ok
23:29:47.0020 0x01b0  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
23:29:47.0059 0x01b0  sppsvc - ok
23:29:47.0074 0x01b0  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
23:29:47.0076 0x01b0  sppuinotify - ok
23:29:47.0093 0x01b0  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
23:29:47.0098 0x01b0  srv - ok
23:29:47.0116 0x01b0  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
23:29:47.0121 0x01b0  srv2 - ok
23:29:47.0133 0x01b0  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
23:29:47.0135 0x01b0  srvnet - ok
23:29:47.0144 0x01b0  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
23:29:47.0148 0x01b0  SSDPSRV - ok
23:29:47.0160 0x01b0  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
23:29:47.0162 0x01b0  SstpSvc - ok
23:29:47.0197 0x01b0  [ CC7ED069C2FC82B5B1555C2044C765CC, CE43363544A3EE2C5133CD0D47BF34AFAFA4EAD6AC9EB9A772EE55E89D4D89D4 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
23:29:47.0206 0x01b0  Steam Client Service - ok
23:29:47.0277 0x01b0  [ D2230317777033CD0456990BFC4994E5, 0F2F559593EAD7AB4596E67E9AE56E5ABF5C945201366CFC972357C22A4F776A ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
23:29:47.0287 0x01b0  Stereo Service - ok
23:29:47.0301 0x01b0  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
23:29:47.0302 0x01b0  stexstor - ok
23:29:47.0357 0x01b0  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
23:29:47.0373 0x01b0  stisvc - ok
23:29:47.0394 0x01b0  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
23:29:47.0395 0x01b0  swenum - ok
23:29:47.0419 0x01b0  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
23:29:47.0428 0x01b0  swprv - ok
23:29:47.0496 0x01b0  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
23:29:47.0516 0x01b0  SysMain - ok
23:29:47.0547 0x01b0  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
23:29:47.0549 0x01b0  TabletInputService - ok
23:29:47.0575 0x01b0  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
23:29:47.0584 0x01b0  TapiSrv - ok
23:29:47.0592 0x01b0  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
23:29:47.0595 0x01b0  TBS - ok
23:29:47.0647 0x01b0  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
23:29:47.0668 0x01b0  Tcpip - ok
23:29:47.0705 0x01b0  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
23:29:47.0726 0x01b0  TCPIP6 - ok
23:29:47.0746 0x01b0  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
23:29:47.0747 0x01b0  tcpipreg - ok
23:29:47.0760 0x01b0  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
23:29:47.0761 0x01b0  TDPIPE - ok
23:29:47.0777 0x01b0  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
23:29:47.0778 0x01b0  TDTCP - ok
23:29:47.0802 0x01b0  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
23:29:47.0806 0x01b0  tdx - ok
23:29:47.0820 0x01b0  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
23:29:47.0822 0x01b0  TermDD - ok
23:29:47.0857 0x01b0  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
23:29:47.0867 0x01b0  TermService - ok
23:29:47.0886 0x01b0  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
23:29:47.0887 0x01b0  Themes - ok
23:29:47.0905 0x01b0  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
23:29:47.0906 0x01b0  THREADORDER - ok
23:29:47.0918 0x01b0  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
23:29:47.0923 0x01b0  TrkWks - ok
23:29:47.0973 0x01b0  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
23:29:47.0979 0x01b0  TrustedInstaller - ok
23:29:48.0011 0x01b0  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
23:29:48.0012 0x01b0  tssecsrv - ok
23:29:48.0043 0x01b0  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
23:29:48.0045 0x01b0  TsUsbFlt - ok
23:29:48.0071 0x01b0  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
23:29:48.0075 0x01b0  tunnel - ok
23:29:48.0089 0x01b0  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
23:29:48.0091 0x01b0  uagp35 - ok
23:29:48.0115 0x01b0  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
23:29:48.0123 0x01b0  udfs - ok
23:29:48.0146 0x01b0  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
23:29:48.0148 0x01b0  UI0Detect - ok
23:29:48.0170 0x01b0  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
23:29:48.0171 0x01b0  uliagpkx - ok
23:29:48.0182 0x01b0  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
23:29:48.0183 0x01b0  umbus - ok
23:29:48.0203 0x01b0  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
23:29:48.0204 0x01b0  UmPass - ok
23:29:48.0214 0x01b0  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
23:29:48.0219 0x01b0  upnphost - ok
23:29:48.0237 0x01b0  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
23:29:48.0239 0x01b0  usbccgp - ok
23:29:48.0252 0x01b0  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
23:29:48.0254 0x01b0  usbcir - ok
23:29:48.0265 0x01b0  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
23:29:48.0266 0x01b0  usbehci - ok
23:29:48.0285 0x01b0  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
23:29:48.0289 0x01b0  usbhub - ok
23:29:48.0292 0x01b0  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
23:29:48.0293 0x01b0  usbohci - ok
23:29:48.0307 0x01b0  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
23:29:48.0307 0x01b0  usbprint - ok
23:29:48.0319 0x01b0  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:29:48.0320 0x01b0  USBSTOR - ok
23:29:48.0323 0x01b0  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
23:29:48.0324 0x01b0  usbuhci - ok
23:29:48.0339 0x01b0  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
23:29:48.0340 0x01b0  UxSms - ok
23:29:48.0348 0x01b0  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
23:29:48.0349 0x01b0  VaultSvc - ok
23:29:48.0365 0x01b0  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
23:29:48.0366 0x01b0  vdrvroot - ok
23:29:48.0383 0x01b0  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
23:29:48.0390 0x01b0  vds - ok
23:29:48.0476 0x01b0  [ BEDDB6B3304B67C142B776BDCB1922CB, 3BEF18E03093F7888E66004280EB1CA567B5D7C7EDEE01507B8A4FD7AA4ECB90 ] Verifies and fixes application compatibility issues C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
23:29:48.0479 0x01b0  Verifies and fixes application compatibility issues - ok
23:29:48.0492 0x01b0  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
23:29:48.0493 0x01b0  vga - ok
23:29:48.0504 0x01b0  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
23:29:48.0506 0x01b0  VgaSave - ok
23:29:48.0523 0x01b0  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
23:29:48.0530 0x01b0  vhdmp - ok
23:29:48.0546 0x01b0  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
23:29:48.0548 0x01b0  viaide - ok
23:29:48.0564 0x01b0  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
23:29:48.0567 0x01b0  volmgr - ok
23:29:48.0605 0x01b0  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
23:29:48.0616 0x01b0  volmgrx - ok
23:29:48.0637 0x01b0  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
23:29:48.0642 0x01b0  volsnap - ok
23:29:48.0659 0x01b0  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
23:29:48.0662 0x01b0  vsmraid - ok
23:29:48.0726 0x01b0  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
23:29:48.0744 0x01b0  VSS - ok
23:29:48.0758 0x01b0  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
23:29:48.0759 0x01b0  vwifibus - ok
23:29:48.0791 0x01b0  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
23:29:48.0803 0x01b0  W32Time - ok
23:29:48.0819 0x01b0  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
23:29:48.0820 0x01b0  WacomPen - ok
23:29:48.0833 0x01b0  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
23:29:48.0834 0x01b0  WANARP - ok
23:29:48.0837 0x01b0  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
23:29:48.0838 0x01b0  Wanarpv6 - ok
23:29:48.0913 0x01b0  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
23:29:48.0933 0x01b0  WatAdminSvc - ok
23:29:48.0969 0x01b0  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
23:29:48.0986 0x01b0  wbengine - ok
23:29:48.0998 0x01b0  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
23:29:49.0001 0x01b0  WbioSrvc - ok
23:29:49.0021 0x01b0  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
23:29:49.0026 0x01b0  wcncsvc - ok
23:29:49.0034 0x01b0  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
23:29:49.0036 0x01b0  WcsPlugInService - ok
23:29:49.0042 0x01b0  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
23:29:49.0043 0x01b0  Wd - ok
23:29:49.0082 0x01b0  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
23:29:49.0091 0x01b0  Wdf01000 - ok
23:29:49.0099 0x01b0  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
23:29:49.0101 0x01b0  WdiServiceHost - ok
23:29:49.0104 0x01b0  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
23:29:49.0106 0x01b0  WdiSystemHost - ok
23:29:49.0127 0x01b0  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
23:29:49.0130 0x01b0  WebClient - ok
23:29:49.0142 0x01b0  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
23:29:49.0145 0x01b0  Wecsvc - ok
23:29:49.0154 0x01b0  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
23:29:49.0156 0x01b0  wercplsupport - ok
23:29:49.0159 0x01b0  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
23:29:49.0161 0x01b0  WerSvc - ok
23:29:49.0174 0x01b0  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
23:29:49.0175 0x01b0  WfpLwf - ok
23:29:49.0185 0x01b0  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
23:29:49.0186 0x01b0  WIMMount - ok
23:29:49.0209 0x01b0  WinDefend - ok
23:29:49.0214 0x01b0  WinHttpAutoProxySvc - ok
23:29:49.0257 0x01b0  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
23:29:49.0263 0x01b0  Winmgmt - ok
23:29:49.0327 0x01b0  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
23:29:49.0350 0x01b0  WinRM - ok
23:29:49.0392 0x01b0  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
23:29:49.0393 0x01b0  WinUsb - ok
23:29:49.0434 0x01b0  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
23:29:49.0448 0x01b0  Wlansvc - ok
23:29:49.0471 0x01b0  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
23:29:49.0471 0x01b0  WmiAcpi - ok
23:29:49.0487 0x01b0  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
23:29:49.0490 0x01b0  wmiApSrv - ok
23:29:49.0504 0x01b0  WMPNetworkSvc - ok
23:29:49.0517 0x01b0  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
23:29:49.0519 0x01b0  WPCSvc - ok
23:29:49.0534 0x01b0  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
23:29:49.0540 0x01b0  WPDBusEnum - ok
23:29:49.0553 0x01b0  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
23:29:49.0555 0x01b0  ws2ifsl - ok
23:29:49.0568 0x01b0  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
23:29:49.0571 0x01b0  wscsvc - ok
23:29:49.0573 0x01b0  WSearch - ok
23:29:49.0640 0x01b0  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
23:29:49.0670 0x01b0  wuauserv - ok
23:29:49.0692 0x01b0  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
23:29:49.0693 0x01b0  WudfPf - ok
23:29:49.0719 0x01b0  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
23:29:49.0726 0x01b0  WUDFRd - ok
23:29:49.0749 0x01b0  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
23:29:49.0754 0x01b0  wudfsvc - ok
23:29:49.0783 0x01b0  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
23:29:49.0792 0x01b0  WwanSvc - ok
23:29:49.0796 0x01b0  ================ Scan global ===============================
23:29:49.0822 0x01b0  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
23:29:49.0851 0x01b0  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
23:29:49.0883 0x01b0  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
23:29:49.0901 0x01b0  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
23:29:49.0927 0x01b0  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
23:29:49.0936 0x01b0  [ Global ] - ok
23:29:49.0936 0x01b0  ================ Scan MBR ==================================
23:29:49.0979 0x01b0  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
23:29:50.0092 0x01b0  \Device\Harddisk0\DR0 - ok
23:29:50.0095 0x01b0  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
23:29:50.0151 0x01b0  \Device\Harddisk1\DR1 - ok
23:29:50.0179 0x01b0  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
23:29:50.0347 0x01b0  \Device\Harddisk2\DR2 - ok
23:29:50.0352 0x01b0  [ 23B571400A29918F5392F6E85EEB756E ] \Device\Harddisk3\DR3
23:29:50.0358 0x01b0  \Device\Harddisk3\DR3 - ok
23:29:50.0359 0x01b0  ================ Scan VBR ==================================
23:29:50.0368 0x01b0  [ 3CDE65928CB1A502DC7337FE338DD228 ] \Device\Harddisk0\DR0\Partition1
23:29:50.0410 0x01b0  \Device\Harddisk0\DR0\Partition1 - ok
23:29:50.0413 0x01b0  [ 7DA4E357A6DC1749D9E4FB08D174AEB8 ] \Device\Harddisk0\DR0\Partition2
23:29:50.0448 0x01b0  \Device\Harddisk0\DR0\Partition2 - ok
23:29:50.0451 0x01b0  [ 781288DC4F4184E3E9ED9E769C1D8A98 ] \Device\Harddisk1\DR1\Partition1
23:29:50.0453 0x01b0  \Device\Harddisk1\DR1\Partition1 - ok
23:29:50.0455 0x01b0  [ F50711CA36152A55E05597984E26E41A ] \Device\Harddisk1\DR1\Partition2
23:29:50.0456 0x01b0  \Device\Harddisk1\DR1\Partition2 - ok
23:29:50.0459 0x01b0  [ 7147791ED8133D843CCC68B125A82014 ] \Device\Harddisk2\DR2\Partition1
23:29:50.0504 0x01b0  \Device\Harddisk2\DR2\Partition1 - ok
23:29:50.0507 0x01b0  [ 337333DCDEC4F0437F3BBF75495EC8E3 ] \Device\Harddisk2\DR2\Partition2
23:29:50.0553 0x01b0  \Device\Harddisk2\DR2\Partition2 - ok
23:29:50.0557 0x01b0  [ 4C7D35EDABB555983263623FF715C8F2 ] \Device\Harddisk3\DR3\Partition1
23:29:50.0559 0x01b0  \Device\Harddisk3\DR3\Partition1 - ok
23:29:50.0559 0x01b0  ================ Scan generic autorun ======================
23:29:50.0645 0x01b0  [ 4F46EA70C7579052F764D0F9B81D23C2, EABE443ABC39AFDA49762A78711FAB4C7367680BE4F0B79F3144362D4A272238 ] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
23:29:50.0664 0x01b0  NvBackend - ok
23:29:50.0693 0x01b0  InstallerLauncher - ok
23:29:50.0861 0x01b0  [ C019E2FEB48A2B618E03A9FCD879B72A, 585B8072337C9E11BE1854E2A062E59CDCEC1406292987E6FDCA752F1848FD4E ] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
23:29:50.0921 0x01b0  egui - ok
23:29:51.0029 0x01b0  [ 7EE68A122ED08E4AAD8DA551E34D2515, B3C9AB270AF595D3DBAFBF4A312B96CBF00C16F0A03CCC86BE56825CD1EB7143 ] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
23:29:51.0073 0x01b0  SDTray - ok
23:29:51.0113 0x01b0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
23:29:51.0126 0x01b0  Sidebar - ok
23:29:51.0145 0x01b0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
23:29:51.0147 0x01b0  mctadmin - ok
23:29:51.0181 0x01b0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
23:29:51.0193 0x01b0  Sidebar - ok
23:29:51.0197 0x01b0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
23:29:51.0198 0x01b0  mctadmin - ok
23:29:51.0199 0x01b0  Waiting for KSN requests completion. In queue: 310
23:29:52.0199 0x01b0  Waiting for KSN requests completion. In queue: 310
23:29:53.0199 0x01b0  Waiting for KSN requests completion. In queue: 310
23:29:54.0227 0x01b0  AV detected via SS2: ESET NOD32 Antivirus 8.0, C:\Program Files\ESET\ESET NOD32 Antivirus\ecmd.exe ( 8.0.304.0 ), 0x41000 ( enabled : updated )
23:29:54.0233 0x01b0  Win FW state via NFP2: enabled
23:29:56.0623 0x01b0  ============================================================
23:29:56.0623 0x01b0  Scan finished
23:29:56.0623 0x01b0  ============================================================
23:29:56.0632 0x07d4  Detected object count: 0
23:29:56.0632 0x07d4  Actual detected object count: 0
         

Während des scannens hat jetzt just nod32 angefangen mir das zu sagen:

10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/cure2.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/rkfund.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/keinfund.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/scan.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/options.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/if1.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/ksn.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/cure.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/eula.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/update.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/starttdss.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/uactdss.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/exe.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/about.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/cure2.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/rkfund.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/keinfund.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/scan.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/options.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/if1.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/ksn.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/eula.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/update.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/starttdss.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/uactdss.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:58	hxxp://deeprybka.trojaner-board.de/tdss/exe.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:57	hxxp://deeprybka.trojaner-board.de/tdss/about.png	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
10.01.2015 23:25:57	hxxp://deeprybka.trojaner-board.de/tdss/cure.PNG	Gesperrt durch interne Negativliste	C:\Program Files (x86)\Mozilla Firefox\firefox.exe	Jörg-PC\Jörg
         

Gruß WMS85

Das is ja mal nen geiler Fehlalarm


Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 15-01-08.01 - Jörg 11.01.2015  19:40:43.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16351.14238 [GMT 1:00]
ausgeführt von:: c:\users\J÷rg\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
SP: ESET NOD32 Antivirus 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1419616801.bdinstall.bin
c:\programdata\1420809997.bdinstall.bin
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-12-11 bis 2015-01-11  ))))))))))))))))))))))))))))))
.
.
2015-01-11 18:44 . 2015-01-11 18:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-01-10 22:06 . 2015-01-10 22:06	--------	d-----w-	c:\programdata\Malwarebytes
2015-01-10 22:06 . 2015-01-10 22:13	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-01-10 22:06 . 2015-01-10 22:06	135384	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-01-10 22:05 . 2015-01-10 22:05	96472	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-01-10 13:26 . 2015-01-10 13:26	--------	d-----w-	c:\program files (x86)\VS Revo Group
2015-01-10 12:46 . 2015-01-10 19:46	--------	d-----w-	C:\FRST
2015-01-10 00:53 . 2015-01-10 00:53	--------	d-----w-	c:\users\Jörg\AppData\Local\ESET
2015-01-09 23:38 . 2015-01-09 23:38	--------	d-----w-	c:\program files\ESET
2015-01-09 19:37 . 2014-12-15 03:13	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{0E05036D-666D-4AC0-A8C6-FE2F8E0FDD70}\mpengine.dll
2015-01-09 16:58 . 2015-01-09 16:58	--------	d-sh--w-	c:\users\Jörg\AppData\Local\EmieBrowserModeList
2015-01-09 16:56 . 2015-01-09 16:56	--------	d-----w-	c:\program files (x86)\ESET
2015-01-09 16:49 . 2015-01-09 16:49	--------	d-----w-	c:\windows\ERUNT
2015-01-09 16:36 . 2015-01-09 16:38	--------	d-----w-	c:\users\Jörg\AppData\Roaming\Dropbox
2015-01-09 15:24 . 2013-09-20 09:49	21040	----a-w-	c:\windows\system32\sdnclean64.exe
2015-01-09 15:24 . 2015-01-09 16:32	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2015-01-09 15:24 . 2015-01-09 15:35	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2015-01-07 15:44 . 2015-01-07 15:44	--------	d-----w-	c:\users\Jörg\AppData\Roaming\TrojanHunter
2015-01-07 14:27 . 2015-01-09 15:27	--------	d-----w-	c:\program files (x86)\TrojanHunter 5.6
2015-01-05 17:18 . 2015-01-10 12:06	--------	d-----w-	C:\AdwCleaner
2015-01-01 07:08 . 2015-01-10 19:42	--------	d-----w-	c:\users\Jörg\AppData\Roaming\Compatibility Verifier
2014-12-31 16:29 . 2015-01-02 01:40	--------	d-----w-	c:\program files\Recuva
2014-12-31 16:17 . 2014-12-31 16:20	--------	d-----w-	C:\SeaTemp
2014-12-26 18:37 . 2014-12-26 18:37	74512	----a-w-	c:\windows\system32\bdsandboxuiskin32.dll
2014-12-26 18:05 . 2009-07-15 00:21	1721576	----a-w-	c:\windows\system32\WdfCoInstaller01009.dll
2014-12-26 18:05 . 2014-12-26 18:05	--------	d-----w-	c:\programdata\BDLogging
2014-12-26 18:05 . 2013-11-04 15:47	74512	----a-w-	c:\windows\SysWow64\bdsandboxuiskin32.dll
2014-12-26 18:05 . 2007-04-11 10:11	511328	----a-w-	c:\windows\capicom.dll
2014-12-26 18:00 . 2014-12-26 18:36	84848	----a-w-	c:\windows\system32\bdsandboxuiskin.dll
2014-12-26 18:00 . 2014-12-26 18:35	34384	----a-w-	c:\windows\system32\bdsandboxuh.dll
2014-12-26 18:00 . 2015-01-09 13:39	--------	d-----w-	c:\program files\Bitdefender
2014-12-26 00:04 . 2015-01-09 13:37	--------	d-----w-	c:\program files\Common Files\Bitdefender
2014-12-25 23:46 . 2014-12-25 23:46	--------	d-----w-	c:\program files (x86)\Common Files\Bitdefender
2014-12-25 22:51 . 2014-10-14 10:00	397312	----a-w-	c:\windows\SysWow64\TubeFinder.exe
2014-12-25 22:51 . 2011-09-22 10:05	84512	----a-w-	c:\windows\SysWow64\PICCLP32.OCX
2014-12-25 22:51 . 2011-09-22 10:05	364544	----a-w-	c:\windows\SysWow64\PropertyGrid.ocx
2014-12-25 22:51 . 2011-09-22 10:05	119568	----a-w-	c:\windows\SysWow64\VB6FR.DLL
2014-12-25 22:51 . 2011-09-22 10:05	101888	----a-w-	c:\windows\SysWow64\VB6STKIT.DLL
2014-12-25 22:51 . 2014-12-25 22:51	--------	d-----w-	c:\users\Jörg\AppData\Roaming\FreeFLVConverter
2014-12-25 22:51 . 2011-09-22 10:05	9728	----a-w-	c:\windows\SysWow64\PCCLPFR.DLL
2014-12-25 22:51 . 2011-09-22 10:05	32768	----a-w-	c:\windows\SysWow64\CMDLGFR.DLL
2014-12-25 22:51 . 2011-09-22 10:05	24576	----a-w-	c:\windows\SysWow64\ControlSubX.ocx
2014-12-25 22:51 . 2011-09-22 10:05	152848	----a-w-	c:\windows\SysWow64\COMDLG32.OCX
2014-12-25 22:51 . 2011-09-22 10:05	141312	----a-w-	c:\windows\SysWow64\MSCMCFR.DLL
2014-12-25 22:51 . 2011-09-22 10:05	1081616	----a-w-	c:\windows\SysWow64\mscomctl.ocx
2014-12-25 22:50 . 2014-12-26 00:04	--------	d-----w-	c:\program files (x86)\Free FLV Converter
2014-12-19 03:57 . 2014-12-19 03:57	--------	d-----w-	c:\windows\SysWow64\Wat
2014-12-19 03:57 . 2014-12-19 03:57	--------	d-----w-	c:\windows\system32\Wat
2014-12-18 08:30 . 2014-12-13 05:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-18 08:30 . 2014-12-13 03:33	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-09 23:35 . 2014-05-05 06:59	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-09 23:35 . 2014-05-05 06:59	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-06 03:36 . 2014-05-05 06:49	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-10 02:01 . 2014-11-24 17:44	112710672	----a-w-	c:\windows\system32\MRT.exe
2014-12-04 02:50 . 2014-12-10 00:10	413184	----a-w-	c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-10 00:10	741376	----a-w-	c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-10 00:10	396800	----a-w-	c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-10 00:10	830976	----a-w-	c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-10 00:10	192000	----a-w-	c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-10 00:10	227328	----a-w-	c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-10 00:10	1083392	----a-w-	c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-10 00:10	1232040	----a-w-	c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-10 00:10	389296	----a-w-	c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-10 00:10	25059840	----a-w-	c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-10 00:10	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-10 00:10	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-10 00:10	66560	----a-w-	c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-10 00:10	580096	----a-w-	c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-10 00:10	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-10 00:10	2885120	----a-w-	c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-10 00:10	88064	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-10 00:10	54784	----a-w-	c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-10 00:10	34304	----a-w-	c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-10 00:10	633856	----a-w-	c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-10 00:10	114688	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-10 00:10	814080	----a-w-	c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-10 00:10	6039552	----a-w-	c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-10 00:10	968704	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-10 00:10	490496	----a-w-	c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-10 00:10	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-10 00:10	77824	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-10 00:10	199680	----a-w-	c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-10 00:10	92160	----a-w-	c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-10 00:10	501248	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-10 00:10	62464	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-10 00:10	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-10 00:10	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-10 00:10	316928	----a-w-	c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-10 00:10	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-10 00:10	718848	----a-w-	c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-10 00:10	800768	----a-w-	c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-10 00:10	1359360	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-10 00:10	2125312	----a-w-	c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-10 00:10	14412800	----a-w-	c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-10 00:10	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-10 00:10	4299264	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-10 00:10	2358272	----a-w-	c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-10 00:10	2052096	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-10 00:10	1155072	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-10 00:10	1548288	----a-w-	c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-10 00:10	800768	----a-w-	c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-10 00:10	1888256	----a-w-	c:\windows\SysWow64\wininet.dll
2014-11-11 03:09 . 2014-12-10 00:10	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-24 17:40	241152	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-24 17:40	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-10 00:10	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-24 17:40	186880	----a-w-	c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-24 17:40	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-10 00:10	119296	----a-w-	c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-10 00:09	2048	----a-w-	c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-10 00:09	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-10-30 02:03 . 2014-12-10 00:09	165888	----a-w-	c:\windows\system32\charmap.exe
2014-10-30 01:45 . 2014-12-10 00:09	155136	----a-w-	c:\windows\SysWow64\charmap.exe
2014-10-25 01:57 . 2014-11-24 17:37	77824	----a-w-	c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-24 17:37	67584	----a-w-	c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-24 17:37	861696	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-18 02:05 . 2014-12-10 02:00	4121600	----a-w-	c:\windows\system32\mf.dll
2014-10-18 01:33 . 2014-11-24 17:37	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2014-10-18 01:33 . 2014-12-10 02:00	3209728	----a-w-	c:\windows\SysWow64\mf.dll
2014-10-14 02:16 . 2014-11-24 17:40	155064	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 02:13 . 2014-11-24 17:40	683520	----a-w-	c:\windows\system32\termsrv.dll
2014-10-14 02:13 . 2014-11-24 17:37	3241984	----a-w-	c:\windows\system32\msi.dll
2014-10-14 02:12 . 2014-11-24 17:40	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-10-14 02:09 . 2014-11-24 17:40	146432	----a-w-	c:\windows\system32\msaudite.dll
2014-10-14 02:07 . 2014-11-24 17:40	681984	----a-w-	c:\windows\system32\adtschema.dll
2014-10-14 01:50 . 2014-11-24 17:40	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-10-14 01:50 . 2014-11-24 17:37	2363904	----a-w-	c:\windows\SysWow64\msi.dll
2014-10-14 01:49 . 2014-11-24 17:40	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-10-14 01:47 . 2014-11-24 17:40	146432	----a-w-	c:\windows\SysWow64\msaudite.dll
2014-10-14 01:46 . 2014-11-24 17:40	681984	----a-w-	c:\windows\SysWow64\adtschema.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09	131480	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
.
c:\users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-1-9 39206760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Verifies and fixes application compatibility issues;Compatibility Verify;c:\users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe;c:\users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x]
S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-05 23:35]
.
2015-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13 11:27]
.
2015-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-13 11:27]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10	164760	----a-w-	c:\users\Jörg\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-03-20 1797064]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2014-10-01 5595336]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mDefault_Page_URL = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\
.
.
------- Dateityp-Verknüpfung -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-Run-Bitdefender-Geldbörse-Agent - c:\program files\Bitdefender\Bitdefender\pmbxag.exe
Wow6432Node-HKU-Default-Run-Bitdefender-Geldbörse - c:\program files\Bitdefender\Bitdefender\pwdmanui.exe
Wow6432Node-HKU-Default-Run-Bitdefender-Geldbörse-Anwendungs-Agent - c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_246_Plugin.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-InstallerLauncher - c:\program files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe
AddRemove-Free FLV Converter - c:\program files (x86)\Free FLV Converter\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-01-11  19:45:58
ComboFix-quarantined-files.txt  2015-01-11 18:45
.
Vor Suchlauf: 10 Verzeichnis(se), 696.276.152.320 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 696.190.640.128 Bytes frei
.
- - End Of File - - B2AF5E03DE7E8BBA24869D7B2F72A3E9
A36C5E4F47E84449FF07ED3517B43A31
         

Combofix hat kurz gemeckert, dass Spybot SD noch laufen würde, wurde aber komplett beendet.

Sorry hat etwas länger gedauert, musste erst zur Sonntagsschicht :/

Und immer wieder danke

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

MBAM:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 11.01.2015
Suchlauf-Zeit: 21:09:35
Logdatei: addmbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.11.10
Rootkit Datenbank: v2015.01.07.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Jörg

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 338194
Verstrichene Zeit: 4 Min, 30 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 3
PUP.Optional.Vosteran, HKLM\SOFTWARE\CLASSES\APPID\{4CB3598A-82E8-4D1F-983F-061238AE696E}, In Quarantäne, [bb6b09ed9dec80b6bcc6bd2439c9c43c], 
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{4CB3598A-82E8-4D1F-983F-061238AE696E}, In Quarantäne, [bb6b09ed9dec80b6bcc6bd2439c9c43c], 
PUP.Optional.CompatibilityVerifier.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Verifies and fixes application compatibility issues, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 

Registrierungswerte: 1
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\\, In Quarantäne, [9294ad496e1b9f9755e234bbbc4847b9]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 2
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\locales, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 

Dateien: 13
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\cef.pak, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\cef_100_percent.pak, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\cef_200_percent.pak, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\d3dcompiler_46.dll, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\debug.log, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\icudtl.dat, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libEGL.dll, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\libGLESv2.dll, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 
PUP.Optional.CompatibilityVerifier.A, C:\Users\Jörg\AppData\Roaming\Compatibility Verifier\vcredist_x86.exe, In Quarantäne, [44e2b93de1a838fe52a1ee7b8c77eb15], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

AdwCleaner:

# AdwCleaner v4.107 - Bericht erstellt am 11/01/2015 um 21:30:03
# Aktualisiert 07/01/2015 von Xplode
# Database : 2015-01-11.2 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Jörg - JÖRG-PC
# Gestartet von : C:\Users\Jörg\Downloads\AdwCleaner_4.107(1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
Ordner Gelöscht : C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
Ordner Gelöscht : C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
Ordner Gelöscht : C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v34.0 (x86 de)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [3484 octets] - [05/01/2015 18:19:24]
AdwCleaner[R1].txt - [1075 octets] - [09/01/2015 17:52:24]
AdwCleaner[R2].txt - [1041 octets] - [10/01/2015 00:11:42]
AdwCleaner[R3].txt - [1102 octets] - [10/01/2015 13:05:25]
AdwCleaner[R4].txt - [1676 octets] - [11/01/2015 21:29:19]
AdwCleaner[S0].txt - [3218 octets] - [05/01/2015 18:21:01]
AdwCleaner[S1].txt - [1091 octets] - [09/01/2015 17:53:13]
AdwCleaner[S2].txt - [1597 octets] - [11/01/2015 21:30:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1657 octets] ##########
         

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by J”rg on 11.01.2015 at 21:34:05,82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.01.2015 at 21:35:15,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:



FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2015
Ran by Jörg (administrator) on JÖRG-PC on 11-01-2015 21:37:45
Running from C:\Users\Jörg\Downloads
Loaded Profile: Jörg (Available profiles: Jörg)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Jörg\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595336 2014-10-01] (ESET)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-12]
FF Extension: Fox!Box - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi [2014-12-09]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR StartupUrls: Default -> "hxxp://Vosteran.com/?f=7&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=", "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (YouTube) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-12-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1349576 2014-10-01] (ESET)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-09-22] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [241368 2014-09-22] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [169280 2014-09-22] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [158968 2014-09-22] (ESET)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 21:37 - 2015-01-11 21:37 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64(1).exe
2015-01-11 21:35 - 2015-01-11 21:35 - 00000624 _____ () C:\Users\Jörg\Desktop\JRT.txt
2015-01-11 21:08 - 2015-01-11 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-11 21:08 - 2015-01-11 21:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-11 21:08 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-11 21:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-11 21:07 - 2015-01-11 21:07 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT(1).exe
2015-01-11 21:06 - 2015-01-11 21:06 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jörg\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-11 21:06 - 2015-01-11 21:06 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107(1).exe
2015-01-11 19:45 - 2015-01-11 19:45 - 00028806 _____ () C:\ComboFix.txt
2015-01-11 19:38 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-11 19:38 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-11 19:38 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-11 19:37 - 2015-01-11 19:46 - 00000000 ____D () C:\Qoobox
2015-01-11 19:36 - 2015-01-11 19:45 - 00000000 ____D () C:\Windows\erdnt
2015-01-11 19:35 - 2015-01-11 19:35 - 05609736 ____R (Swearware) C:\Users\Jörg\Desktop\ComboFix.exe
2015-01-10 23:09 - 2015-01-10 23:26 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\Jörg\Downloads\tdsskiller.exe
2015-01-10 23:06 - 2015-01-11 21:32 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-10 23:06 - 2015-01-11 21:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-10 23:06 - 2015-01-10 23:13 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-10 23:05 - 2015-01-10 23:24 - 00000000 ____D () C:\Users\Jörg\Desktop\mbar
2015-01-10 23:05 - 2015-01-10 23:05 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001(2).exe
2015-01-10 23:05 - 2015-01-10 23:05 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001(1).exe
2015-01-10 23:05 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-10 20:51 - 2015-01-10 20:51 - 00003545 _____ () C:\Users\Jörg\Downloads\gmerlog.log
2015-01-10 20:45 - 2015-01-10 20:46 - 00023314 _____ () C:\Users\Jörg\Downloads\Addition.txt
2015-01-10 20:44 - 2015-01-11 21:37 - 00010784 _____ () C:\Users\Jörg\Downloads\FRST.txt
2015-01-10 20:43 - 2015-01-10 20:43 - 00000470 _____ () C:\Users\Jörg\Downloads\defogger_disable.log
2015-01-10 20:42 - 2015-01-10 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (4)
2015-01-10 20:41 - 2015-01-10 20:41 - 00003258 _____ () C:\Windows\System32\Tasks\{CD82DDA7-9231-4C19-9908-079D065BCB1C}
2015-01-10 20:39 - 2015-01-10 20:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jörg\Downloads\revosetup95.exe
2015-01-10 14:27 - 2015-01-10 14:27 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001.exe
2015-01-10 14:26 - 2015-01-10 14:26 - 00001268 _____ () C:\Users\Jörg\Desktop\Revo Uninstaller.lnk
2015-01-10 14:26 - 2015-01-10 14:26 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-10 13:51 - 2015-01-10 13:51 - 00380416 _____ () C:\Users\Jörg\Downloads\Gmer-19357.exe
2015-01-10 13:46 - 2015-01-11 21:37 - 00000000 ____D () C:\FRST
2015-01-10 13:45 - 2015-01-10 13:46 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64.exe
2015-01-10 13:44 - 2015-01-10 13:44 - 00000000 _____ () C:\Users\Jörg\defogger_reenable
2015-01-10 13:43 - 2015-01-10 13:43 - 00050477 _____ () C:\Users\Jörg\Downloads\Defogger.exe
2015-01-10 01:53 - 2015-01-10 01:53 - 00000000 ____D () C:\Users\Jörg\AppData\Local\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\Program Files\ESET
2015-01-10 00:33 - 2015-01-10 00:33 - 01761992 _____ (ESET) C:\Users\Jörg\Downloads\eset_nod32_antivirus_live_installer_.exe
2015-01-09 17:58 - 2015-01-09 17:58 - 00000000 __SHD () C:\Users\Jörg\AppData\Local\EmieBrowserModeList
2015-01-09 17:56 - 2015-01-09 17:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-09 17:55 - 2015-01-09 17:56 - 02347384 _____ (ESET) C:\Users\Jörg\Downloads\esetsmartinstaller_deu.exe
2015-01-09 17:51 - 2015-01-09 17:51 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107.exe
2015-01-09 17:49 - 2015-01-09 17:49 - 00000000 ____D () C:\Windows\ERUNT
2015-01-09 17:48 - 2015-01-09 17:48 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT.exe
2015-01-09 17:38 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 17:36 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Dropbox
2015-01-09 17:35 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150109-173535.backup
2015-01-09 16:24 - 2015-01-09 17:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-09 16:24 - 2015-01-09 16:35 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2015-01-09 16:24 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-07 16:44 - 2015-01-07 16:44 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TrojanHunter
2015-01-07 15:27 - 2015-01-09 16:27 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2015-01-07 15:27 - 2015-01-07 15:27 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2015-01-06 10:26 - 2015-01-06 10:26 - 00292776 _____ () C:\Windows\Minidump\010615-13197-01.dmp
2015-01-05 18:18 - 2015-01-11 21:30 - 00000000 ____D () C:\AdwCleaner
2015-01-04 23:45 - 2015-01-04 23:45 - 00000000 ____D () C:\Users\Jörg\Documents\Klei
2015-01-04 01:33 - 2015-01-04 01:33 - 00002212 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2015-01-04 01:33 - 2015-01-04 01:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2015-01-01 21:52 - 2015-01-02 12:26 - 00000000 ____D () C:\Users\Jörg\Documents\gg
2014-12-31 17:29 - 2015-01-02 02:40 - 00000000 ____D () C:\Program Files\Recuva
2014-12-31 17:29 - 2014-12-31 17:29 - 00001658 _____ () C:\Users\Public\Desktop\Recuva.lnk
2014-12-31 17:17 - 2014-12-31 17:20 - 00000000 ____D () C:\SeaTemp
2014-12-30 23:05 - 2014-12-30 23:05 - 00007236 _____ () C:\Users\Jörg\Documents\poxxparty.xspf
2014-12-30 22:29 - 2014-12-31 17:14 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner
2014-12-30 21:35 - 2015-01-09 17:21 - 00000000 ____D () C:\Users\Jörg\Documents\festlatte
2014-12-27 13:34 - 2014-12-27 13:34 - 00296888 _____ () C:\Windows\Minidump\122714-12230-01.dmp
2014-12-26 22:43 - 2014-12-26 22:43 - 00000000 ____D () C:\Users\Jörg\Documents\BB FlashBack Express 5 Updates
2014-12-26 22:33 - 2014-12-26 22:33 - 00296856 _____ () C:\Windows\Minidump\122614-14352-01.dmp
2014-12-26 19:37 - 2014-12-26 19:37 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-12-26 19:24 - 2014-12-26 19:39 - 00000408 _____ () C:\Windows\system32\checkdnsid.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000385 _____ () C:\Windows\system32\user_gensett.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____D () C:\ProgramData\BDLogging
2014-12-26 19:05 - 2013-11-04 16:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-12-26 19:05 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2014-12-26 19:05 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2014-12-26 19:00 - 2015-01-09 14:39 - 00000000 ____D () C:\Program Files\Bitdefender
2014-12-26 19:00 - 2014-12-26 19:36 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll
2014-12-26 19:00 - 2014-12-26 19:35 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll
2014-12-26 01:04 - 2015-01-09 14:37 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-12-25 23:51 - 2014-12-25 23:51 - 00001173 _____ () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00001121 _____ () C:\Users\Jörg\Desktop\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\FreeFLVConverter
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter
2014-12-25 23:51 - 2014-10-14 11:00 - 00397312 _____ () C:\Windows\SysWOW64\TubeFinder.exe
2014-12-25 23:51 - 2011-09-22 11:05 - 01081616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2014-12-25 23:51 - 2011-09-22 11:05 - 00152848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2014-12-25 23:50 - 2014-12-26 01:04 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2014-12-19 13:00 - 2014-12-19 12:04 - 01510216 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-12-04-50.log
2014-12-19 12:27 - 2014-12-19 12:01 - 00616683 _____ () C:\Users\Jörg\Desktop\C_2014-12-19-11-59-05.log
2014-12-19 11:19 - 2014-12-19 11:19 - 00000000 ____D () C:\Users\Jörg\Desktop\screenshots
2014-12-18 09:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 09:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 18:56 - 2014-12-17 18:56 - 00293408 _____ () C:\Windows\Minidump\121714-11138-01.dmp
2014-12-17 18:43 - 2014-12-17 18:43 - 00293384 _____ () C:\Windows\Minidump\121714-11856-01.dmp
2014-12-15 07:22 - 2014-12-15 07:22 - 00293376 _____ () C:\Windows\Minidump\121514-14430-01.dmp
2014-12-12 20:39 - 2014-12-12 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (3)
2014-12-12 09:52 - 2014-12-16 05:13 - 00000000 ____D () C:\Program Files (x86)\BEAF8266-AE64-40A2-BF8D-99F4FB145C26

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 21:37 - 2014-05-13 12:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-11 21:35 - 2014-05-04 22:36 - 01822219 _____ () C:\Windows\WindowsUpdate.log
2015-01-11 21:32 - 2014-05-05 07:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-11 21:31 - 2014-05-13 12:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-11 21:30 - 2014-05-06 14:12 - 00359762 _____ () C:\Windows\PFRO.log
2015-01-11 21:30 - 2014-05-05 07:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-11 21:30 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-11 21:30 - 2009-07-14 05:51 - 00030476 _____ () C:\Windows\setupact.log
2015-01-11 21:30 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-11 21:30 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-11 19:45 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-11 19:44 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-11 19:43 - 2014-05-13 12:32 - 00000000 ____D () C:\ProgramData\Temp
2015-01-10 18:15 - 2014-10-15 23:25 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.EU
2015-01-10 15:17 - 2014-11-26 19:49 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.NET
2015-01-10 13:44 - 2014-05-04 22:36 - 00000000 ____D () C:\Users\Jörg
2015-01-10 13:43 - 2014-12-05 21:17 - 00000682 _____ () C:\Users\Jörg\Desktop\Neues Textdokument.txt
2015-01-10 13:05 - 2014-10-03 13:16 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Skype
2015-01-10 04:41 - 2014-11-28 15:14 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\vlc
2015-01-10 03:06 - 2014-11-26 00:04 - 00000000 ____D () C:\Users\Jörg\Desktop\tN-.]H$!
2015-01-10 02:00 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-10 02:00 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-10 02:00 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-10 00:35 - 2014-05-05 07:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-10 00:35 - 2014-05-05 07:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-10 00:35 - 2014-05-05 07:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-10 00:34 - 2014-05-05 07:57 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 00:31 - 2014-05-13 12:24 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Adobe
2015-01-10 00:28 - 2014-10-03 12:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 17:59 - 2014-11-25 04:59 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Macro Toolworks
2015-01-09 17:58 - 2014-05-13 12:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-09 14:00 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-09 03:12 - 2014-11-28 04:26 - 00000000 ____D () C:\Users\Jörg\dwhelper
2015-01-07 15:28 - 2014-10-03 12:11 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-07 15:23 - 2014-10-24 22:20 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TS3Client
2015-01-06 10:26 - 2014-05-13 14:08 - 00000000 ____D () C:\Windows\Minidump
2015-01-06 10:26 - 2014-05-13 14:07 - 648425529 _____ () C:\Windows\MEMORY.DMP
2015-01-06 04:36 - 2014-05-05 07:49 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 18:18 - 2014-12-06 20:03 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\QuickScan
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ____D () C:\ProgramData\Skype
2015-01-04 19:56 - 2014-11-26 19:48 - 00000000 ____D () C:\Program Files (x86)\PokerStars.NET
2015-01-04 03:08 - 2014-10-08 19:25 - 00000000 ____D () C:\Users\Jörg\Documents\my games
2015-01-04 01:33 - 2014-05-13 12:27 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Google
2015-01-03 16:09 - 2014-10-15 23:25 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-12-31 16:58 - 2014-11-26 00:08 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Blueberry
2014-12-26 22:48 - 2014-11-26 00:08 - 00001420 _____ () C:\Users\Public\Desktop\BB FlashBack Express Recorder.lnk
2014-12-26 22:48 - 2014-11-26 00:08 - 00001410 _____ () C:\Users\Public\Desktop\BB FlashBack Express Player.lnk
2014-12-19 14:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\Jörg\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqftcbc.dll
C:\Users\Jörg\AppData\Local\Temp\Quarantine.exe
C:\Users\Jörg\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 11:12

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---



Gruß WMS85

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hi Schrauber,
ob noch tatsächlich Probleme bestehen kann ich gerade noch nicht sagen, das muss der Langzeittest Zeigen.
Werde heute wohl etwas länger am Rechner sitzen dürfen und dann auch Rückmeldung geben, ob etwas aufgefallen ist oder nicht.


ESET:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7fe9e30862738547acc9913ef5365cbf
# engine=21890
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-09 05:52:30
# local_time=2015-01-09 06:52:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 18781 4008550 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 17417 172455800 0 0
# scanned=167197
# found=1
# cleaned=0
# scan_time=3186
sh=DC7CD8D267A8C7B8972C10097B7D2BEC052E922E ft=1 fh=52cde0534a366f28 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-4201028278-1513335983-2328483318-1000\$RLIBUDS.exe"
# product=EOS
# version=8
# IEXPLORE.EXE=11.00.9600.16428 (winblue_gdr.131013-1700)
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7fe9e30862738547acc9913ef5365cbf
# engine=21896
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-09 11:19:50
# local_time=2015-01-10 12:19:50 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 15255 4028190 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 13342 172475440 0 0
# scanned=20453
# found=1
# cleaned=0
# scan_time=198
sh=DC7CD8D267A8C7B8972C10097B7D2BEC052E922E ft=1 fh=52cde0534a366f28 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-4201028278-1513335983-2328483318-1000\$RLIBUDS.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7fe9e30862738547acc9913ef5365cbf
# engine=21914
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-11 11:33:29
# local_time=2015-01-12 12:33:29 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 3597 172649059 0 0
# compatibility_mode_1='ESET NOD32 Antivirus 8.0'
# compatibility_mode=8229 16777213 100 100 172338 9648803 0 0
# scanned=169304
# found=0
# cleaned=0
# scan_time=1452
# nod_component=V3 Build:0x30000000
         

SecurityCheck: (hab ich da was falsch gemacht?)

 UNSUPPORTED OPERATING SYSTEM! ABORTED!
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2015
Ran by Jörg (administrator) on JÖRG-PC on 12-01-2015 00:48:53
Running from C:\Users\Jörg\Downloads
Loaded Profile: Jörg (Available profiles: Jörg)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Jörg\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5595336 2014-10-01] (ESET)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
Startup: C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jörg\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-4201028278-1513335983-2328483318-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-12]
FF Extension: Fox!Box - C:\Users\Jörg\AppData\Roaming\Mozilla\Firefox\Profiles\a42kxczq.default\Extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi [2014-12-09]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://Vosteran.com/?f=1&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR StartupUrls: Default -> "hxxp://Vosteran.com/?f=7&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=", "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbc_14_49_ff&cd=2XzuyEtN2Y1L1Qzu0CzzyCtDtDtDzy0Fzy0B0FtCtD0EyByBtN0D0Tzu0StCtDyCzytN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEzyyDyBtDtAtBzytGyBtAyDtCtGyC0Fzz0CtGtDtAtB0DtGyD0AtCzy0E0FtD0FtA0CzyyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByCtAzy0EyCtByBtG0Czy0B0DtGyE0D0AyBtG0AtB0AtCtGtCyC0AtDyE0E0EyE0DyDyCtC2Q&cr=887336021&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (YouTube) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Bitdefender QuickScan) - C:\Users\Jörg\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-12-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1349576 2014-10-01] (ESET)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-09-22] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [241368 2014-09-22] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [169280 2014-09-22] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [158968 2014-09-22] (ESET)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-12 00:09 - 2015-01-12 00:09 - 00852505 _____ () C:\Users\Jörg\Desktop\SecurityCheck.exe
2015-01-12 00:08 - 2015-01-12 00:08 - 02347384 _____ (ESET) C:\Users\Jörg\Downloads\esetsmartinstaller_deu(1).exe
2015-01-11 21:42 - 2015-01-11 21:42 - 00004157 _____ () C:\Users\Jörg\Desktop\addmbam.txt
2015-01-11 21:37 - 2015-01-11 21:37 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64(1).exe
2015-01-11 21:08 - 2015-01-11 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-11 21:08 - 2015-01-11 21:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-11 21:08 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-11 21:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-11 21:07 - 2015-01-11 21:07 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT(1).exe
2015-01-11 21:06 - 2015-01-11 21:06 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Jörg\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-11 21:06 - 2015-01-11 21:06 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107(1).exe
2015-01-11 19:45 - 2015-01-11 19:45 - 00028806 _____ () C:\ComboFix.txt
2015-01-11 19:38 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-11 19:38 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-11 19:38 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-11 19:38 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-11 19:37 - 2015-01-11 19:46 - 00000000 ____D () C:\Qoobox
2015-01-11 19:36 - 2015-01-11 19:45 - 00000000 ____D () C:\Windows\erdnt
2015-01-11 19:35 - 2015-01-11 19:35 - 05609736 ____R (Swearware) C:\Users\Jörg\Desktop\ComboFix.exe
2015-01-10 23:09 - 2015-01-10 23:26 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\Jörg\Downloads\tdsskiller.exe
2015-01-10 23:06 - 2015-01-11 21:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-10 23:06 - 2015-01-11 21:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-10 23:06 - 2015-01-10 23:13 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-10 23:05 - 2015-01-10 23:24 - 00000000 ____D () C:\Users\Jörg\Desktop\mbar
2015-01-10 23:05 - 2015-01-10 23:05 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001(2).exe
2015-01-10 23:05 - 2015-01-10 23:05 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001(1).exe
2015-01-10 23:05 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-10 20:51 - 2015-01-10 20:51 - 00003545 _____ () C:\Users\Jörg\Downloads\gmerlog.log
2015-01-10 20:44 - 2015-01-12 00:49 - 00010727 _____ () C:\Users\Jörg\Downloads\FRST.txt
2015-01-10 20:43 - 2015-01-10 20:43 - 00000470 _____ () C:\Users\Jörg\Downloads\defogger_disable.log
2015-01-10 20:42 - 2015-01-10 20:43 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner (4)
2015-01-10 20:41 - 2015-01-10 20:41 - 00003258 _____ () C:\Windows\System32\Tasks\{CD82DDA7-9231-4C19-9908-079D065BCB1C}
2015-01-10 20:39 - 2015-01-10 20:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jörg\Downloads\revosetup95.exe
2015-01-10 14:27 - 2015-01-10 14:27 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Jörg\Downloads\mbar-1.08.2.1001.exe
2015-01-10 14:26 - 2015-01-10 14:26 - 00001268 _____ () C:\Users\Jörg\Desktop\Revo Uninstaller.lnk
2015-01-10 14:26 - 2015-01-10 14:26 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-10 13:51 - 2015-01-10 13:51 - 00380416 _____ () C:\Users\Jörg\Downloads\Gmer-19357.exe
2015-01-10 13:46 - 2015-01-12 00:48 - 00000000 ____D () C:\FRST
2015-01-10 13:45 - 2015-01-10 13:46 - 02124288 _____ (Farbar) C:\Users\Jörg\Downloads\FRST64.exe
2015-01-10 13:44 - 2015-01-10 13:44 - 00000000 _____ () C:\Users\Jörg\defogger_reenable
2015-01-10 13:43 - 2015-01-10 13:43 - 00050477 _____ () C:\Users\Jörg\Downloads\Defogger.exe
2015-01-10 01:53 - 2015-01-10 01:53 - 00000000 ____D () C:\Users\Jörg\AppData\Local\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\ProgramData\ESET
2015-01-10 00:38 - 2015-01-10 00:38 - 00000000 ____D () C:\Program Files\ESET
2015-01-10 00:33 - 2015-01-10 00:33 - 01761992 _____ (ESET) C:\Users\Jörg\Downloads\eset_nod32_antivirus_live_installer_.exe
2015-01-09 17:58 - 2015-01-09 17:58 - 00000000 __SHD () C:\Users\Jörg\AppData\Local\EmieBrowserModeList
2015-01-09 17:56 - 2015-01-09 17:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-09 17:55 - 2015-01-09 17:56 - 02347384 _____ (ESET) C:\Users\Jörg\Downloads\esetsmartinstaller_deu.exe
2015-01-09 17:51 - 2015-01-09 17:51 - 02191360 _____ () C:\Users\Jörg\Downloads\AdwCleaner_4.107.exe
2015-01-09 17:49 - 2015-01-09 17:49 - 00000000 ____D () C:\Windows\ERUNT
2015-01-09 17:48 - 2015-01-09 17:48 - 01707939 _____ (Thisisu) C:\Users\Jörg\Downloads\JRT.exe
2015-01-09 17:38 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-09 17:36 - 2015-01-09 17:38 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Dropbox
2015-01-09 17:35 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150109-173535.backup
2015-01-09 16:24 - 2015-01-09 17:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-09 16:24 - 2015-01-09 16:35 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2015-01-09 16:24 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-09 16:24 - 2015-01-09 16:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-09 16:24 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-07 16:44 - 2015-01-07 16:44 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TrojanHunter
2015-01-07 15:27 - 2015-01-09 16:27 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2015-01-07 15:27 - 2015-01-07 15:27 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2015-01-06 10:26 - 2015-01-06 10:26 - 00292776 _____ () C:\Windows\Minidump\010615-13197-01.dmp
2015-01-05 18:18 - 2015-01-11 21:30 - 00000000 ____D () C:\AdwCleaner
2015-01-04 23:45 - 2015-01-04 23:45 - 00000000 ____D () C:\Users\Jörg\Documents\Klei
2015-01-04 01:33 - 2015-01-04 01:33 - 00002212 _____ () C:\Users\Public\Desktop\Google Earth.lnk
2015-01-04 01:33 - 2015-01-04 01:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2015-01-01 21:52 - 2015-01-02 12:26 - 00000000 ____D () C:\Users\Jörg\Documents\gg
2014-12-31 17:29 - 2015-01-02 02:40 - 00000000 ____D () C:\Program Files\Recuva
2014-12-31 17:29 - 2014-12-31 17:29 - 00001658 _____ () C:\Users\Public\Desktop\Recuva.lnk
2014-12-31 17:17 - 2014-12-31 17:20 - 00000000 ____D () C:\SeaTemp
2014-12-30 23:05 - 2014-12-30 23:05 - 00007236 _____ () C:\Users\Jörg\Documents\poxxparty.xspf
2014-12-30 22:29 - 2014-12-31 17:14 - 00000000 ____D () C:\Users\Jörg\Desktop\Neuer Ordner
2014-12-30 21:35 - 2015-01-09 17:21 - 00000000 ____D () C:\Users\Jörg\Documents\festlatte
2014-12-27 13:34 - 2014-12-27 13:34 - 00296888 _____ () C:\Windows\Minidump\122714-12230-01.dmp
2014-12-26 22:43 - 2014-12-26 22:43 - 00000000 ____D () C:\Users\Jörg\Documents\BB FlashBack Express 5 Updates
2014-12-26 22:33 - 2014-12-26 22:33 - 00296856 _____ () C:\Windows\Minidump\122614-14352-01.dmp
2014-12-26 19:37 - 2014-12-26 19:37 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-12-26 19:24 - 2014-12-26 19:39 - 00000408 _____ () C:\Windows\system32\checkdnsid.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000385 _____ () C:\Windows\system32\user_gensett.xml
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2014-12-26 19:05 - 2014-12-26 19:05 - 00000000 ____D () C:\ProgramData\BDLogging
2014-12-26 19:05 - 2013-11-04 16:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-12-26 19:05 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2014-12-26 19:05 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2014-12-26 19:00 - 2015-01-09 14:39 - 00000000 ____D () C:\Program Files\Bitdefender
2014-12-26 19:00 - 2014-12-26 19:36 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin.dll
2014-12-26 19:00 - 2014-12-26 19:35 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuh.dll
2014-12-26 01:04 - 2015-01-09 14:37 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-12-25 23:51 - 2014-12-25 23:51 - 00001173 _____ () C:\Users\Jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00001121 _____ () C:\Users\Jörg\Desktop\Free FLV Converter.lnk
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\FreeFLVConverter
2014-12-25 23:51 - 2014-12-25 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter
2014-12-25 23:51 - 2014-10-14 11:00 - 00397312 _____ () C:\Windows\SysWOW64\TubeFinder.exe
2014-12-25 23:51 - 2011-09-22 11:05 - 01081616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00364544 _____ () C:\Windows\SysWOW64\PropertyGrid.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00208500 _____ () C:\Windows\SysWOW64\ReyXpBasics.tlb
2014-12-25 23:51 - 2011-09-22 11:05 - 00152848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00084512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2014-12-25 23:51 - 2011-09-22 11:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2014-12-25 23:51 - 2011-09-22 11:05 - 00024576 _____ () C:\Windows\SysWOW64\ControlSubX.ocx
2014-12-25 23:51 - 2011-09-22 11:05 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2014-12-25 23:50 - 2014-12-26 01:04 - 00000000 ____D () C:\Program Files (x86)\Free FLV Converter
2014-12-19 11:19 - 2014-12-19 11:19 - 00000000 ____D () C:\Users\Jörg\Desktop\screenshots
2014-12-18 09:30 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 09:30 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 18:56 - 2014-12-17 18:56 - 00293408 _____ () C:\Windows\Minidump\121714-11138-01.dmp
2014-12-17 18:43 - 2014-12-17 18:43 - 00293384 _____ () C:\Windows\Minidump\121714-11856-01.dmp
2014-12-15 07:22 - 2014-12-15 07:22 - 00293376 _____ () C:\Windows\Minidump\121514-14430-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-12 00:37 - 2014-05-13 12:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-12 00:32 - 2014-05-05 07:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-12 00:08 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-01-12 00:08 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-01-12 00:08 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-12 00:06 - 2014-10-03 12:11 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-11 21:38 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-11 21:38 - 2009-07-14 05:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-11 21:35 - 2014-05-04 22:36 - 01822219 _____ () C:\Windows\WindowsUpdate.log
2015-01-11 21:31 - 2014-05-13 12:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-11 21:30 - 2014-05-06 14:12 - 00359762 _____ () C:\Windows\PFRO.log
2015-01-11 21:30 - 2014-05-05 07:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-11 21:30 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-11 21:30 - 2009-07-14 05:51 - 00030476 _____ () C:\Windows\setupact.log
2015-01-11 19:45 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-11 19:44 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-11 19:43 - 2014-05-13 12:32 - 00000000 ____D () C:\ProgramData\Temp
2015-01-10 18:15 - 2014-10-15 23:25 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.EU
2015-01-10 15:17 - 2014-11-26 19:49 - 00000000 ____D () C:\Users\Jörg\AppData\Local\PokerStars.NET
2015-01-10 13:44 - 2014-05-04 22:36 - 00000000 ____D () C:\Users\Jörg
2015-01-10 13:43 - 2014-12-05 21:17 - 00000682 _____ () C:\Users\Jörg\Desktop\Neues Textdokument.txt
2015-01-10 13:05 - 2014-10-03 13:16 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Skype
2015-01-10 04:41 - 2014-11-28 15:14 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\vlc
2015-01-10 03:06 - 2014-11-26 00:04 - 00000000 ____D () C:\Users\Jörg\Desktop\tN-.]H$!
2015-01-10 00:35 - 2014-05-05 07:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-10 00:35 - 2014-05-05 07:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-10 00:35 - 2014-05-05 07:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-10 00:34 - 2014-05-05 07:57 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-10 00:31 - 2014-05-13 12:24 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Adobe
2015-01-10 00:28 - 2014-10-03 12:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-09 17:59 - 2014-11-25 04:59 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Macro Toolworks
2015-01-09 17:58 - 2014-05-13 12:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-09 14:00 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-09 03:12 - 2014-11-28 04:26 - 00000000 ____D () C:\Users\Jörg\dwhelper
2015-01-07 15:23 - 2014-10-24 22:20 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\TS3Client
2015-01-06 10:26 - 2014-05-13 14:08 - 00000000 ____D () C:\Windows\Minidump
2015-01-06 10:26 - 2014-05-13 14:07 - 648425529 _____ () C:\Windows\MEMORY.DMP
2015-01-06 04:36 - 2014-05-05 07:49 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 18:18 - 2014-12-06 20:03 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\QuickScan
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-04 22:29 - 2014-10-03 13:16 - 00000000 ____D () C:\ProgramData\Skype
2015-01-04 19:56 - 2014-11-26 19:48 - 00000000 ____D () C:\Program Files (x86)\PokerStars.NET
2015-01-04 03:08 - 2014-10-08 19:25 - 00000000 ____D () C:\Users\Jörg\Documents\my games
2015-01-04 01:33 - 2014-05-13 12:27 - 00000000 ____D () C:\Users\Jörg\AppData\Local\Google
2015-01-03 16:09 - 2014-10-15 23:25 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU
2014-12-31 16:58 - 2014-11-26 00:08 - 00000000 ____D () C:\Users\Jörg\AppData\Roaming\Blueberry
2014-12-26 22:48 - 2014-11-26 00:08 - 00001420 _____ () C:\Users\Public\Desktop\BB FlashBack Express Recorder.lnk
2014-12-26 22:48 - 2014-11-26 00:08 - 00001410 _____ () C:\Users\Public\Desktop\BB FlashBack Express Player.lnk
2014-12-19 14:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-16 05:13 - 2014-12-12 09:52 - 00000000 ____D () C:\Program Files (x86)\BEAF8266-AE64-40A2-BF8D-99F4FB145C26

Some content of TEMP:
====================
C:\Users\Jörg\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqftcbc.dll
C:\Users\Jörg\AppData\Local\Temp\Quarantine.exe
C:\Users\Jörg\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 11:12

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

--- --- ---


Wie gesagt, gebe auf jedenfall noch eine Rückmeldung ob noch was "auffälliges" vorliegt.