Windows 7 - Seltsame Verbindungen und Kontaktierungen

defogger_disable by jpshortstuff (23.0210.1)

Log created at 22:53 on 04/03/2015 (Kisha)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015
Ran by Kisha (administrator) on KISHA-PC on 04-03-2015 01:19:22
Running from C:\Users\Kisha\Desktop
Loaded Profiles: Kisha (Available profiles: Kisha & H)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-10-20] (Microsoft Corporation)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4242376083-3955314335-23754567-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Kisha\AppData\Roaming\Mozilla\Firefox\Profiles\jdm44sgl.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Garmin Communicator - C:\Users\Kisha\AppData\Roaming\Mozilla\Firefox\Profiles\jdm44sgl.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-12-24]
FF Extension: Firebug - C:\Users\Kisha\AppData\Roaming\Mozilla\Firefox\Profiles\jdm44sgl.default\Extensions\firebug@software.joehewitt.com.xpi [2015-02-03]
FF Extension: Adblock Plus - C:\Users\Kisha\AppData\Roaming\Mozilla\Firefox\Profiles\jdm44sgl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-01]
FF Extension: Greasemonkey - C:\Users\Kisha\AppData\Roaming\Mozilla\Firefox\Profiles\jdm44sgl.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2015-02-04]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG)
S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-10-11] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-12-13] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-10-11] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-10-11] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2015-01-19] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-10-15] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-10-11] (G Data Software AG)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 01:19 - 2015-03-04 01:20 - 00010421 _____ () C:\Users\Kisha\Desktop\FRST.txt
2015-03-04 01:18 - 2015-03-04 01:19 - 00000000 ____D () C:\FRST
2015-03-04 01:17 - 2015-03-04 01:17 - 02092544 _____ (Farbar) C:\Users\Kisha\Desktop\FRST64.exe
2015-03-04 01:17 - 2015-03-04 01:17 - 00380416 _____ () C:\Users\Kisha\Downloads\Gmer-19357.exe
2015-03-04 01:16 - 2015-03-04 01:16 - 00000472 _____ () C:\Users\Kisha\Desktop\defogger_disable.log
2015-03-04 01:16 - 2015-03-04 01:16 - 00000000 _____ () C:\Users\Kisha\defogger_reenable
2015-03-04 01:14 - 2015-03-04 01:14 - 00050477 _____ () C:\Users\Kisha\Desktop\Defogger.exe
2015-03-04 00:34 - 2015-03-04 00:34 - 00004230 _____ () C:\Users\Kisha\Desktop\mm.txt
2015-03-04 00:15 - 2015-03-04 00:15 - 00291606 _____ () C:\Users\Kisha\Downloads\TCPView.zip
2015-03-04 00:15 - 2015-03-04 00:15 - 00000000 ____D () C:\Users\Kisha\Downloads\TCPView
2015-03-03 15:57 - 2015-03-03 16:12 - 00000000 ____D () C:\Users\Kisha\Downloads\lu
2015-03-03 15:34 - 2015-03-03 15:34 - 00119600 _____ (Microsoft Corporation) C:\Users\Kisha\Downloads\Windows-KB841290-x86-ENU.exe
2015-03-03 15:09 - 2015-03-03 15:09 - 00001038 _____ () C:\Users\Kisha\Desktop\Quick Checksum Verifier.lnk
2015-03-03 15:09 - 2015-03-03 15:09 - 00001038 _____ () C:\Users\H.Kisha-PC\Desktop\Quick Checksum Verifier.lnk
2015-03-03 15:09 - 2015-03-03 15:09 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\Bitdreamers
2015-03-03 15:09 - 2015-03-03 15:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdreamers
2015-03-03 15:09 - 2015-03-03 15:09 - 00000000 ____D () C:\Program Files\Bitdreamers
2015-03-03 15:08 - 2015-03-03 15:08 - 04138571 _____ (Bitdreamers) C:\Users\Kisha\Downloads\checksum_verifier-116-x64.exe
2015-03-02 16:12 - 2015-03-02 16:18 - 79699734 _____ () C:\Users\Kisha\Desktop\1.mp4
2015-03-02 09:09 - 2015-03-02 09:09 - 00000000 ____D () C:\Users\Kisha\Downloads\julius-4.3.1(1).tar
2015-03-02 09:08 - 2015-03-02 09:08 - 01761555 _____ () C:\Users\Kisha\Downloads\julius-4.3.1(1).tar.gz
2015-03-02 09:07 - 2015-03-02 09:07 - 00000000 _____ () C:\Users\Kisha\Downloads\julius-4.3.1.tar.gz
2015-03-01 07:47 - 2015-03-01 07:47 - 00005313 _____ () C:\Users\Kisha\Desktop\training.html
2015-02-25 19:44 - 2015-02-25 19:44 - 00000000 ____D () C:\Users\H.Kisha-PC\Desktop\Bilder Proffesorr
2015-02-25 19:40 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 19:40 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 19:40 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 19:40 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-25 08:13 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 08:13 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 05:01 - 2015-02-25 05:02 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2015-02-25 05:01 - 2015-02-25 05:02 - 00000000 ____D () C:\Program Files (x86)\CodeBlocks
2015-02-25 04:59 - 2015-02-25 04:59 - 00000959 _____ () C:\Users\Kisha\AppData\Roaming\Microsoft\Windows\Start Menu\MinGW Installation Manager.lnk
2015-02-25 04:57 - 2015-02-25 04:57 - 00086528 _____ (MinGW.org Project) C:\Users\Kisha\Downloads\mingw-get-setup.exe
2015-02-25 04:54 - 2015-02-25 04:55 - 102611063 _____ (The Code::Blocks Team) C:\Users\Kisha\Downloads\codeblocks-13.12mingw-setup.exe
2015-02-25 04:00 - 2014-03-16 03:33 - 01007104 _____ () C:\Windows\SysWOW64\SDL2.dll
2015-02-25 04:00 - 2014-03-16 03:33 - 01007104 _____ () C:\Windows\system32\SDL2.dll
2015-02-24 09:13 - 2015-02-24 09:13 - 00000000 ____D () C:\Users\Kisha\Downloads\SDL2_image-devel-2.0.0-mingw
2015-02-24 09:11 - 2015-02-24 09:18 - 00000000 ____D () C:\Users\Kisha\Downloads\SDL2_mixer-devel-2.0.0-mingw.tar
2015-02-24 09:11 - 2015-02-24 09:11 - 02267103 _____ () C:\Users\Kisha\Downloads\SDL2_mixer-devel-2.0.0-mingw.tar.gz
2015-02-24 09:10 - 2015-02-24 09:11 - 01699064 _____ () C:\Users\Kisha\Downloads\SDL2_image-devel-2.0.0-mingw.tar.gz
2015-02-24 08:40 - 2015-02-24 08:40 - 00000000 ____D () C:\Users\Kisha\Downloads\SDL2-devel-2.0.3-mingw.tar
2015-02-24 08:38 - 2015-02-24 08:38 - 08196779 _____ () C:\Users\Kisha\Downloads\SDL2-devel-2.0.3-mingw.tar.gz
2015-02-24 06:17 - 2015-02-24 06:17 - 04178658 _____ () C:\Users\Kisha\Downloads\SDL-devel-1.2.9-mingw32.tar.gz
2015-02-24 04:26 - 2015-02-24 04:31 - 150905704 _____ (Bitnami) C:\Users\Kisha\Downloads\xampp-win32-5.6.3-0-VC11-installer.exe
2015-02-21 10:16 - 2015-02-21 10:16 - 00000000 ____D () C:\Users\Kisha\Downloads\bootstrap-3.3.2-dist
2015-02-20 14:19 - 2015-02-20 14:19 - 00006626 _____ () C:\Users\Kisha\AppData\Local\recently-used.xbel
2015-02-20 02:07 - 2015-02-20 02:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DB Browser for SQLite
2015-02-20 02:07 - 2015-02-20 02:07 - 00000000 ____D () C:\Program Files (x86)\SqliteBrowser3
2015-02-19 06:35 - 2015-02-19 06:35 - 00000000 ____D () C:\Users\Kisha\AppData\Local\pip
2015-02-19 05:47 - 2015-02-20 00:25 - 00000000 ____D () C:\Users\Kisha\AppData\Local\GitHub
2015-02-19 05:47 - 2015-02-20 00:24 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc
2015-02-19 05:47 - 2015-02-19 06:31 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\GitHub
2015-02-19 05:45 - 2015-02-20 00:25 - 00000000 ____D () C:\Users\Kisha\AppData\Local\Apps\2.0
2015-02-19 05:45 - 2015-02-19 06:31 - 00000000 ____D () C:\Users\Kisha\AppData\Local\Deployment
2015-02-17 23:22 - 2015-02-17 23:31 - 00000000 ____D () C:\Users\Kisha\Desktop\Java
2015-02-17 02:13 - 2015-03-04 00:45 - 00007000 _____ () C:\Windows\setupact.log
2015-02-17 02:13 - 2015-02-17 02:13 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-17 01:47 - 2015-02-20 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-02-17 01:47 - 2015-02-17 01:47 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-02-17 01:46 - 2015-02-20 00:25 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-16 16:27 - 2015-02-16 16:27 - 00000000 ____D () C:\ProgramData\Cornelsen
2015-02-15 20:56 - 2015-02-18 21:14 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\FileZilla
2015-02-15 20:55 - 2015-02-15 20:55 - 00000000 ____D () C:\Users\Kisha\Downloads\filezilla_3.10.1.1_win32
2015-02-15 17:31 - 2015-02-15 17:50 - 00000000 ____D () C:\Users\Kisha\Desktop\IT
2015-02-15 16:18 - 2015-02-15 16:18 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\postgresql
2015-02-15 16:05 - 2015-02-15 16:05 - 00000000 ____D () C:\Program Files\PostgreSQL
2015-02-15 16:00 - 2015-02-15 16:00 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-15 06:07 - 2015-02-15 22:06 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\xVideoServiceThief
2015-02-14 03:56 - 2015-02-14 03:56 - 00000000 ____D () C:\Users\Kisha\Desktop\design11
2015-02-12 22:32 - 2015-02-20 15:29 - 00000000 ____D () C:\Users\Kisha\.gimp-2.8
2015-02-12 22:32 - 2015-02-12 22:32 - 00000000 ____D () C:\Users\Kisha\AppData\Local\gegl-0.2
2015-02-12 22:31 - 2015-02-12 22:31 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2015-02-12 22:30 - 2015-02-12 22:31 - 00000000 ____D () C:\Program Files\GIMP 2
2015-02-12 13:36 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 13:36 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 13:36 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 13:36 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 07:57 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 07:57 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 07:57 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 07:57 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 07:57 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 07:57 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 07:57 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 07:57 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 07:57 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 07:57 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 07:57 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 07:57 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 07:57 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 07:57 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 07:57 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 07:57 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 07:57 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 07:57 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 07:57 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 07:57 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 07:57 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 07:57 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 07:57 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 07:57 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 07:57 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 07:57 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 07:57 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 07:57 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 07:57 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 07:57 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 07:57 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 07:57 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 07:57 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 07:57 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 07:57 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 07:57 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 07:57 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 07:57 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 07:57 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 07:57 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 07:57 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 07:57 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 07:57 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 07:57 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 07:57 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 07:57 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 07:57 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 07:57 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 07:57 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 07:57 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 07:57 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 07:57 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 07:57 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 07:57 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 07:57 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 07:57 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 07:57 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 07:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 07:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 07:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 07:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 07:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 07:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 07:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 07:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 07:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 07:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 07:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 07:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 07:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 07:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 07:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 07:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 07:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 07:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 07:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 07:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 07:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 07:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 07:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 07:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 07:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 07:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 07:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 07:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 07:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 07:55 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:55 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 07:55 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 07:55 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 07:55 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 07:55 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 07:55 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 07:55 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 07:55 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:55 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 16:13 - 2015-02-10 16:13 - 00000024 _____ () C:\Users\Kisha\Desktop\jj.txt
2015-02-07 17:12 - 2015-02-08 13:56 - 00000000 ____D () C:\Users\Kisha\Desktop\Spiele
2015-02-06 11:57 - 2015-03-04 01:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-06 11:57 - 2015-02-06 11:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 11:57 - 2015-02-06 11:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-06 11:57 - 2015-02-06 11:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 21:24 - 2015-02-05 21:24 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\TightVNC
2015-02-05 21:23 - 2015-02-20 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TightVNC
2015-02-05 21:23 - 2015-02-05 21:23 - 00000000 ____D () C:\Program Files\TightVNC
2015-02-03 13:23 - 2015-02-03 13:23 - 00000000 ____D () C:\Users\Kisha\Desktop\openssl-master
2015-02-03 10:24 - 2015-02-03 10:29 - 31072379 _____ () C:\Users\Kisha\Downloads\e.flv
2015-02-02 13:59 - 2015-03-02 18:03 - 00000000 ____D () C:\Users\Kisha\Desktop\HTML und CSS

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 01:16 - 2014-10-06 07:17 - 00000000 ____D () C:\Users\Kisha
2015-03-04 01:03 - 2014-10-06 07:11 - 02051531 _____ () C:\Windows\WindowsUpdate.log
2015-03-04 00:52 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-04 00:52 - 2009-07-14 05:45 - 00021392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-04 00:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-03 22:52 - 2014-10-07 12:08 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\Skype
2015-03-03 01:06 - 2014-10-28 12:08 - 00000000 ____D () C:\Users\Kisha\Documents\Anki
2015-03-02 17:38 - 2015-01-16 12:58 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\CodeBlocks
2015-02-28 13:48 - 2009-07-14 18:58 - 00714278 _____ () C:\Windows\system32\perfh007.dat
2015-02-28 13:48 - 2009-07-14 18:58 - 00154330 _____ () C:\Windows\system32\perfc007.dat
2015-02-28 13:48 - 2009-07-14 06:13 - 01648872 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-28 13:37 - 2015-01-15 19:37 - 00000000 ____D () C:\Users\H.Kisha-PC\Desktop\projekt arbeit sevda
2015-02-28 07:59 - 2015-01-15 19:28 - 00000238 _____ () C:\Users\Kisha\Desktop\ojnml.txt
2015-02-28 07:59 - 2014-11-02 07:28 - 00000203 _____ () C:\Users\Kisha\Desktop\Erinnerung Lernplan.txt
2015-02-28 01:35 - 2014-12-01 00:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-27 21:36 - 2014-10-17 08:08 - 00007598 _____ () C:\Users\Kisha\AppData\Local\Resmon.ResmonCfg
2015-02-27 09:59 - 2014-11-02 07:40 - 00000000 ____D () C:\Users\Kisha\AppData\Roaming\vlc
2015-02-27 05:26 - 2014-12-01 00:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-26 21:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-26 14:38 - 2015-01-16 11:56 - 00000000 ____D () C:\Users\Kisha\Desktop\C
2015-02-25 08:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-25 05:01 - 2015-01-16 12:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2015-02-22 13:16 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-02-21 02:32 - 2015-02-01 08:17 - 00000000 ____D () C:\Users\Kisha\Desktop\pythoncode
2015-02-20 14:39 - 2015-01-16 14:12 - 00000000 ____D () C:\Users\Kisha\Desktop\Kunst
2015-02-20 04:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-20 00:25 - 2015-02-01 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-02-20 00:25 - 2015-02-01 07:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.7
2015-02-20 00:25 - 2015-02-01 07:22 - 00000000 ____D () C:\Python27
2015-02-20 00:25 - 2015-01-19 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2015-02-20 00:25 - 2015-01-19 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Vindicator
2015-02-20 00:25 - 2015-01-18 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CamStudio
2015-02-20 00:25 - 2015-01-18 20:58 - 00000000 ____D () C:\Program Files (x86)\CamStudio
2015-02-20 00:25 - 2015-01-16 11:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2015-02-20 00:25 - 2015-01-16 11:45 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-02-20 00:25 - 2014-12-23 22:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2015-02-20 00:25 - 2014-11-06 01:33 - 00000000 ____D () C:\Users\H.Kisha-PC
2015-02-20 00:25 - 2014-11-02 22:17 - 00000000 ____D () C:\Program Files\7-Zip
2015-02-20 00:25 - 2014-10-28 12:06 - 00000000 ____D () C:\Program Files (x86)\Anki
2015-02-20 00:25 - 2014-10-20 17:10 - 00000000 ____D () C:\Windows\system32\SPReview
2015-02-20 00:25 - 2014-10-06 07:24 - 00000000 ____D () C:\Program Files (x86)\Activation Assistant for the 2007 Microsoft Office suites
2015-02-20 00:25 - 2014-10-06 07:21 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2015-02-20 00:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-02-17 23:14 - 2015-01-29 08:55 - 00000000 ____D () C:\Users\Kisha\Desktop\Bewerbung
2015-02-17 01:54 - 2014-10-06 08:07 - 00000000 ____D () C:\Windows\PANTHER
2015-02-16 22:42 - 2015-01-19 19:09 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-15 23:39 - 2015-01-08 06:41 - 00000000 ____D () C:\Users\Kisha\AppData\Local\gtk-2.0
2015-02-15 17:30 - 2015-01-16 14:17 - 00000000 ____D () C:\Users\Kisha\Desktop\Musik
2015-02-12 22:35 - 2014-12-20 15:57 - 00000000 ____D () C:\Users\Kisha\.thumbnails
2015-02-12 13:20 - 2009-07-14 05:45 - 00436120 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 13:17 - 2014-12-11 08:14 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 13:17 - 2014-10-07 05:14 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 13:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-11 23:56 - 2014-10-06 07:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:54 - 2014-10-23 02:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 23:51 - 2014-10-23 02:26 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-06 11:58 - 2014-10-18 14:33 - 00000000 ____D () C:\Users\Kisha\AppData\Local\Adobe

==================== Files in the root of some directories =======

2014-10-11 19:28 - 2014-10-11 19:28 - 0000000 _____ () C:\Users\Kisha\AppData\Roaming\gdfw.log
2014-10-11 19:28 - 2014-10-11 19:28 - 0000779 _____ () C:\Users\Kisha\AppData\Roaming\gdscan.log
2015-02-20 14:19 - 2015-02-20 14:19 - 0006626 _____ () C:\Users\Kisha\AppData\Local\recently-used.xbel
2014-10-17 08:08 - 2015-02-27 21:36 - 0007598 _____ () C:\Users\Kisha\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-24 16:18

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-03-2015
Ran by Kisha at 2015-03-04 01:21:15
Running from C:\Users\Kisha\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Anki (HKLM-x32\...\Anki) (Version:  - )
CamStudio (HKLM-x32\...\CamStudio) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CodeBlocks (HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\CodeBlocks) (Version: 13.12 - The Code::Blocks Team)
DB Browser for SQLite (HKLM-x32\...\SqliteBrowser3) (Version: 3.5.1 - oldsch00l)
FLV-Media-Player (HKLM-x32\...\{AB7A5DBA-BC45-489A-B4D2-2E8F8CABB9EA}) (Version: 2.0.3.2532 - HYBRIDWEB.de)
Freizeitkarte_DEU (Ausgabe 15.01) (HKLM-x32\...\Freizeitkarte_DEU) (Version:  - )
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.4 - G DATA Software AG)
Game Vindicator (HKLM-x32\...\{17B4506C-737C-458E-B7D6-5C0ED8221996}) (Version: 1.1.0 - Game Vindicator)
Garmin BaseCamp (HKLM-x32\...\{31A67F6C-D79D-47B9-9F0B-13C0FCF3C3A8}) (Version: 4.4.6 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.4 - Notepad++ Team)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Python 2.7 pygame-1.9.1 (HKLM-x32\...\{5D13804A-67B7-49DA-9B15-65B70A83B9C3}) (Version: 1.9.1 - Pete Shinners, Rene Dudfield, Marcus von Appen, Bob Pendleton, others...)
Python 2.7.9 (HKLM-x32\...\{79F081BF-7454-43DB-BD8F-9EE596813232}) (Version: 2.7.9150 - Python Software Foundation)
Quick Checksum Verifier (64-Bit) (HKLM-x32\...\QCV) (Version: 1.1.6.2 - Bitdreamers)
Ruby 2.1.3-p242-x64 (HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\{2A5A5972-E912-49C4-9459-F05131507B6E}_is1) (Version: 2.1.3-p242 - RubyInstaller Team)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TightVNC (HKLM\...\{D2372F87-7DA2-47F7-A102-AF2181B8EAA2}) (Version: 2.7.10.0 - GlavSoft LLC.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

24-02-2015 11:01:00 Windows Update
25-02-2015 08:11:52 Windows Update
26-02-2015 05:24:59 Windows Update
03-03-2015 22:32:25 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0F7C9894-69E2-4D80-8DA3-2261F4FA8905} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {4E509C8C-AB89-454F-B1FA-F1BE19F878AF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {5BC35296-1151-4363-9282-881F1E63AAE1} - System32\Tasks\{ECBEA98B-794E-4E3C-9EA6-3A67621C18EE} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=7.1.0.105&LastError=12002
Task: {BDAFCB9D-A5B0-40BA-B979-E09D8FAAB2C9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-02-06 11:57 - 2015-02-06 11:57 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4242376083-3955314335-23754567-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kisha\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Browser => 3
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: c2cautoupdatesvc => 2
MSCONFIG\Services: c2cpnrsvc => 2
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: IEEtwCollectorService => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NvNetworkService => 2
MSCONFIG\Services: NvStreamSvc => 2
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: postgresql-x64-9.4 => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: UMVPFSrv => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: uTorrent => C:\Users\H.Kisha-PC\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED

==================== Accounts: =============================

Administrator (S-1-5-21-4242376083-3955314335-23754567-500 - Administrator - Disabled)
Gast (S-1-5-21-4242376083-3955314335-23754567-501 - Limited - Disabled)
H (S-1-5-21-4242376083-3955314335-23754567-1004 - Limited - Enabled) => C:\Users\H.Kisha-PC
HomeGroupUser$ (S-1-5-21-4242376083-3955314335-23754567-1003 - Limited - Enabled)
Kisha (S-1-5-21-4242376083-3955314335-23754567-1000 - Administrator - Enabled) => C:\Users\Kisha

==================== Faulty Device Manager Devices =============

Name: Video WebCam
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/04/2015 00:33:57 AM) (Source: Wininit) (EventID: 1015) (User: )
Description: Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode 00000000. Der Computer muss neu gestartet werden.

Error: (03/03/2015 03:32:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm QCV.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 210

Startzeit: 01d055bebf5078be

Endzeit: 12

Anwendungspfad: C:\Program Files\Bitdreamers\Quick Checksum Verifier\QCV.exe

Berichts-ID: 16173961-c1b2-11e4-9e46-60eb697ca4e1

Error: (03/03/2015 03:16:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm QCV.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b64

Startzeit: 01d055bba3818c6f

Endzeit: 11

Anwendungspfad: C:\Program Files\Bitdreamers\Quick Checksum Verifier\QCV.exe

Berichts-ID: cf4b8f7b-c1af-11e4-9e46-60eb697ca4e1

Error: (03/02/2015 01:14:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: leerzeichenersetzen.exe, Version: 0.0.0.0, Zeitstempel: 0x54f45416
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000d193
ID des fehlerhaften Prozesses: 0xcfc
Startzeit der fehlerhaften Anwendung: 0xleerzeichenersetzen.exe0
Pfad der fehlerhaften Anwendung: leerzeichenersetzen.exe1
Pfad des fehlerhaften Moduls: leerzeichenersetzen.exe2
Berichtskennung: leerzeichenersetzen.exe3

Error: (03/02/2015 01:14:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: leerzeichenersetzen.exe, Version: 0.0.0.0, Zeitstempel: 0x54f45402
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000d193
ID des fehlerhaften Prozesses: 0xaf8
Startzeit der fehlerhaften Anwendung: 0xleerzeichenersetzen.exe0
Pfad der fehlerhaften Anwendung: leerzeichenersetzen.exe1
Pfad des fehlerhaften Moduls: leerzeichenersetzen.exe2
Berichtskennung: leerzeichenersetzen.exe3

Error: (03/02/2015 08:08:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 36.0.0.5531, Zeitstempel: 0x54eb029a
Name des fehlerhaften Moduls: mozalloc.dll, Version: 36.0.0.5531, Zeitstempel: 0x54eaf3b7
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001e02
ID des fehlerhaften Prozesses: 0xfa4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/28/2015 08:04:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm codeblocks.exe, Version 13.12.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 117c

Startzeit: 01d0532429195335

Endzeit: 21

Anwendungspfad: C:\Program Files (x86)\CodeBlocks\codeblocks.exe

Berichts-ID: ef44ad88-bf17-11e4-8c52-60eb697ca4e1

Error: (02/26/2015 05:00:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Untitled2.exe, Version: 0.0.0.0, Zeitstempel: 0x54ef42ff
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000ce2a
ID des fehlerhaften Prozesses: 0x13d8
Startzeit der fehlerhaften Anwendung: 0xUntitled2.exe0
Pfad der fehlerhaften Anwendung: Untitled2.exe1
Pfad des fehlerhaften Moduls: Untitled2.exe2
Berichtskennung: Untitled2.exe3

Error: (02/26/2015 03:27:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: getchar.exe, Version: 0.0.0.0, Zeitstempel: 0x54ef2d59
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000ce2a
ID des fehlerhaften Prozesses: 0xa14
Startzeit der fehlerhaften Anwendung: 0xgetchar.exe0
Pfad der fehlerhaften Anwendung: getchar.exe1
Pfad des fehlerhaften Moduls: getchar.exe2
Berichtskennung: getchar.exe3

Error: (02/26/2015 02:35:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xec0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3


System errors:
=============
Error: (03/04/2015 00:51:56 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "SSDP-Suche" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "UPnP-Gerätehost" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "SSDP-Suche" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:45:01 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎04.‎03.‎2015 um 00:35:42 unerwartet heruntergefahren.

Error: (03/04/2015 00:34:21 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (03/02/2015 07:45:46 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎02.‎03.‎2015 um 01:04:26 unerwartet heruntergefahren.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 32%
Total physical RAM: 6108.93 MB
Available physical RAM: 4116.64 MB
Total Pagefile: 12216.05 MB
Available Pagefile: 9643.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:215.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 000C5EE1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-03-2015
Ran by Kisha at 2015-03-04 01:21:15
Running from C:\Users\Kisha\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Anki (HKLM-x32\...\Anki) (Version:  - )
CamStudio (HKLM-x32\...\CamStudio) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CodeBlocks (HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\CodeBlocks) (Version: 13.12 - The Code::Blocks Team)
DB Browser for SQLite (HKLM-x32\...\SqliteBrowser3) (Version: 3.5.1 - oldsch00l)
FLV-Media-Player (HKLM-x32\...\{AB7A5DBA-BC45-489A-B4D2-2E8F8CABB9EA}) (Version: 2.0.3.2532 - HYBRIDWEB.de)
Freizeitkarte_DEU (Ausgabe 15.01) (HKLM-x32\...\Freizeitkarte_DEU) (Version:  - )
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.4 - G DATA Software AG)
Game Vindicator (HKLM-x32\...\{17B4506C-737C-458E-B7D6-5C0ED8221996}) (Version: 1.1.0 - Game Vindicator)
Garmin BaseCamp (HKLM-x32\...\{31A67F6C-D79D-47B9-9F0B-13C0FCF3C3A8}) (Version: 4.4.6 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.4 - Notepad++ Team)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Python 2.7 pygame-1.9.1 (HKLM-x32\...\{5D13804A-67B7-49DA-9B15-65B70A83B9C3}) (Version: 1.9.1 - Pete Shinners, Rene Dudfield, Marcus von Appen, Bob Pendleton, others...)
Python 2.7.9 (HKLM-x32\...\{79F081BF-7454-43DB-BD8F-9EE596813232}) (Version: 2.7.9150 - Python Software Foundation)
Quick Checksum Verifier (64-Bit) (HKLM-x32\...\QCV) (Version: 1.1.6.2 - Bitdreamers)
Ruby 2.1.3-p242-x64 (HKU\S-1-5-21-4242376083-3955314335-23754567-1000\...\{2A5A5972-E912-49C4-9459-F05131507B6E}_is1) (Version: 2.1.3-p242 - RubyInstaller Team)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TightVNC (HKLM\...\{D2372F87-7DA2-47F7-A102-AF2181B8EAA2}) (Version: 2.7.10.0 - GlavSoft LLC.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

24-02-2015 11:01:00 Windows Update
25-02-2015 08:11:52 Windows Update
26-02-2015 05:24:59 Windows Update
03-03-2015 22:32:25 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0F7C9894-69E2-4D80-8DA3-2261F4FA8905} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {4E509C8C-AB89-454F-B1FA-F1BE19F878AF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {5BC35296-1151-4363-9282-881F1E63AAE1} - System32\Tasks\{ECBEA98B-794E-4E3C-9EA6-3A67621C18EE} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=7.1.0.105&LastError=12002
Task: {BDAFCB9D-A5B0-40BA-B979-E09D8FAAB2C9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-02-06 11:57 - 2015-02-06 11:57 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4242376083-3955314335-23754567-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kisha\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Browser => 3
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: c2cautoupdatesvc => 2
MSCONFIG\Services: c2cpnrsvc => 2
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: IEEtwCollectorService => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NvNetworkService => 2
MSCONFIG\Services: NvStreamSvc => 2
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: postgresql-x64-9.4 => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: UMVPFSrv => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: uTorrent => C:\Users\H.Kisha-PC\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED

==================== Accounts: =============================

Administrator (S-1-5-21-4242376083-3955314335-23754567-500 - Administrator - Disabled)
Gast (S-1-5-21-4242376083-3955314335-23754567-501 - Limited - Disabled)
H (S-1-5-21-4242376083-3955314335-23754567-1004 - Limited - Enabled) => C:\Users\H.Kisha-PC
HomeGroupUser$ (S-1-5-21-4242376083-3955314335-23754567-1003 - Limited - Enabled)
Kisha (S-1-5-21-4242376083-3955314335-23754567-1000 - Administrator - Enabled) => C:\Users\Kisha

==================== Faulty Device Manager Devices =============

Name: Video WebCam
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/04/2015 00:33:57 AM) (Source: Wininit) (EventID: 1015) (User: )
Description: Ein kritischer Systemprozess C:\Windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode 00000000. Der Computer muss neu gestartet werden.

Error: (03/03/2015 03:32:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm QCV.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 210

Startzeit: 01d055bebf5078be

Endzeit: 12

Anwendungspfad: C:\Program Files\Bitdreamers\Quick Checksum Verifier\QCV.exe

Berichts-ID: 16173961-c1b2-11e4-9e46-60eb697ca4e1

Error: (03/03/2015 03:16:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm QCV.exe, Version 1.1.6.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b64

Startzeit: 01d055bba3818c6f

Endzeit: 11

Anwendungspfad: C:\Program Files\Bitdreamers\Quick Checksum Verifier\QCV.exe

Berichts-ID: cf4b8f7b-c1af-11e4-9e46-60eb697ca4e1

Error: (03/02/2015 01:14:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: leerzeichenersetzen.exe, Version: 0.0.0.0, Zeitstempel: 0x54f45416
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000d193
ID des fehlerhaften Prozesses: 0xcfc
Startzeit der fehlerhaften Anwendung: 0xleerzeichenersetzen.exe0
Pfad der fehlerhaften Anwendung: leerzeichenersetzen.exe1
Pfad des fehlerhaften Moduls: leerzeichenersetzen.exe2
Berichtskennung: leerzeichenersetzen.exe3

Error: (03/02/2015 01:14:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: leerzeichenersetzen.exe, Version: 0.0.0.0, Zeitstempel: 0x54f45402
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000d193
ID des fehlerhaften Prozesses: 0xaf8
Startzeit der fehlerhaften Anwendung: 0xleerzeichenersetzen.exe0
Pfad der fehlerhaften Anwendung: leerzeichenersetzen.exe1
Pfad des fehlerhaften Moduls: leerzeichenersetzen.exe2
Berichtskennung: leerzeichenersetzen.exe3

Error: (03/02/2015 08:08:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 36.0.0.5531, Zeitstempel: 0x54eb029a
Name des fehlerhaften Moduls: mozalloc.dll, Version: 36.0.0.5531, Zeitstempel: 0x54eaf3b7
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001e02
ID des fehlerhaften Prozesses: 0xfa4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/28/2015 08:04:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm codeblocks.exe, Version 13.12.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 117c

Startzeit: 01d0532429195335

Endzeit: 21

Anwendungspfad: C:\Program Files (x86)\CodeBlocks\codeblocks.exe

Berichts-ID: ef44ad88-bf17-11e4-8c52-60eb697ca4e1

Error: (02/26/2015 05:00:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Untitled2.exe, Version: 0.0.0.0, Zeitstempel: 0x54ef42ff
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000ce2a
ID des fehlerhaften Prozesses: 0x13d8
Startzeit der fehlerhaften Anwendung: 0xUntitled2.exe0
Pfad der fehlerhaften Anwendung: Untitled2.exe1
Pfad des fehlerhaften Moduls: Untitled2.exe2
Berichtskennung: Untitled2.exe3

Error: (02/26/2015 03:27:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: getchar.exe, Version: 0.0.0.0, Zeitstempel: 0x54ef2d59
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000ce2a
ID des fehlerhaften Prozesses: 0xa14
Startzeit der fehlerhaften Anwendung: 0xgetchar.exe0
Pfad der fehlerhaften Anwendung: getchar.exe1
Pfad des fehlerhaften Moduls: getchar.exe2
Berichtskennung: getchar.exe3

Error: (02/26/2015 02:35:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xec0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3


System errors:
=============
Error: (03/04/2015 00:51:56 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "SSDP-Suche" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "UPnP-Gerätehost" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "SSDP-Suche" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:51:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/04/2015 00:45:01 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎04.‎03.‎2015 um 00:35:42 unerwartet heruntergefahren.

Error: (03/04/2015 00:34:21 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (03/02/2015 07:45:46 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎02.‎03.‎2015 um 01:04:26 unerwartet heruntergefahren.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (02/28/2015 05:31:44 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 32%
Total physical RAM: 6108.93 MB
Available physical RAM: 4116.64 MB
Total Pagefile: 12216.05 MB
Available Pagefile: 9643.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:215.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 000C5EE1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-04 23:05:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-22A23T0 rev.01.01A01 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Kisha\AppData\Local\Temp\ugloqpow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000075961401 2 bytes JMP 7533b21b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000075961419 2 bytes JMP 7533b346 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000075961431 2 bytes JMP 753b8ea9 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007596144a 2 bytes CALL 753148ad C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                           * 9
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000759614dd 2 bytes JMP 753b87a2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000759614f5 2 bytes JMP 753b8978 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007596150d 2 bytes JMP 753b8698 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000075961525 2 bytes JMP 753b8a62 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007596153d 2 bytes JMP 7532fca8 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000075961555 2 bytes JMP 753368ef C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007596156d 2 bytes JMP 753b8f61 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000075961585 2 bytes JMP 753b8ac2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007596159d 2 bytes JMP 753b865c C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000759615b5 2 bytes JMP 7532fd41 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000759615cd 2 bytes JMP 7533b2dc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000759616b2 2 bytes JMP 753b8e24 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000759616bd 2 bytes JMP 753b85f1 C:\Windows\syswow64\kernel32.dll

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4080:3952]                                                                                000007fefb6d2bf8
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4080:112]                                                                                 000007feef3b4830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4080:676]                                                                                 000007feef3b4830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [4080:3780]                                                                                000007fef8b75124

---- EOF - GMER 2.1 ----