Hi

Hier das Log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by julian at 2015-03-30 21:20:54 Run:3
Running from C:\Users\julian\Desktop
Loaded Profiles: julian (Available profiles: julian)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Windows\pss\7ca6a7fec2df0d82a777ae67fbedc9eb.exe.Startup

HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
S2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe" [X]
S2 avgwd; "C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe" [X]
S2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [X]
Emptytemp:
*****************

"C:\Windows\pss\7ca6a7fec2df0d82a777ae67fbedc9eb.exe.Startup" => File/Directory not found.
"HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
AVGIDSAgent => Service deleted successfully.
avgwd => Service deleted successfully.
WtuSystemSupport => Service deleted successfully.
EmptyTemp: => Removed 526.2 MB temporary data.
         

und der Rest?

Hi

Habe schon ein paar Updates gemacht.

Das mit den Geräuschen hatte ich doch beschrieben.

Gruß

Den Satz hab ich überlesen, sorry. Kam der Ton nochmal? Poste bitte noch ein frisches FRST log.

Hi

Nein es kam seit dem kein Ton mehr. Noch eine frage: Kann ein Virus aus der Virtualbox austreten und somit auf den richtigen Rechner umgreifen? Habe noch ein Windows XP in der VirtualBox laufen.

Hier die Logs:

Users shortcut scan result (x64) Version: 11-03-2015
Ran by julian at 2015-04-01 10:23:04
Running from C:\Users\julian\Desktop
Boot Mode: Normal
==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)



Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk -> C:\Windows\ehome\ehshell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk -> C:\Windows\System32\WindowsAnytimeUpgradeUI.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk -> C:\Program Files\DVD Maker\DVDMaker.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Benutzerhandbuch für die Konsolenversion von RAR.lnk -> C:\Program Files\WinRAR\Rar.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Hilfe zu WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Was ist neu in dieser Version.lnk -> C:\Program Files\WinRAR\WhatsNew.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.exe (Alexander Roshal)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Uninstall.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Uninstall.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Vidalia Website.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Vidalia\Vidalia Website.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Vidalia.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Vidalia\vidalia.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Tor Website.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Tor\Tor Website.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Tor.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Tor\tor.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Documents\Tor Documentation.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Tor\Documents ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Documents\Tor Manual.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Tor\Documents\tor-reference.html (No File)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Documents\Tor Specification.lnk -> C:\Program Files (x86)\Vidalia Bridge Bundle\Tor\Documents\tor-spec.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt\TrueCrypt.lnk -> C:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimDrivers\SlimDrivers.lnk -> C:\Windows\Installer\{03E312F7-8697-4BC4-A90F-33D34EECE18C}\Icon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk -> C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Resource Hacker\Resource Hacker.lnk -> C:\Program Files (x86)\Resource Hacker\ResHacker.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\PE Viewer.lnk -> C:\Program Files\Process Hacker 2\peview.exe (wj32)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Process Hacker 2.lnk -> C:\Program Files\Process Hacker 2\ProcessHacker.exe (wj32)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Uninstall Process Hacker 2.lnk -> C:\Program Files\Process Hacker 2\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Help and Support\Changelog.lnk -> C:\Program Files\Process Hacker 2\CHANGELOG.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\PeerBlock.lnk -> C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\Uninstall PeerBlock.lnk -> C:\Program Files\PeerBlock\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\Help and Support\ReadMe.lnk -> C:\Program Files\PeerBlock\readme.rtf ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\License (English).lnk -> C:\Program Files\Oracle\VirtualBox\License_en_US.rtf ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\Oracle VM VirtualBox.lnk -> C:\Program Files\Oracle\VirtualBox\VirtualBox.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (CHM, English).lnk -> C:\Program Files\Oracle\VirtualBox\VirtualBox.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox\User manual (PDF, English).lnk -> C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\accicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\xlicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office InfoPath 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\inficon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pptico.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pubs.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\wordicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digitale Signatur für VBA-Projekte.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\cagicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Spracheinstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Access Snapshot Viewer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\oisicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware entfernen.lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware .lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Tools\Malwarebytes Anti-Malware Chameleon.lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\chameleon.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk -> C:\Windows\System32\recdisc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk -> C:\Windows\System32\msra.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT\Kingo ROOT.lnk -> C:\Program Files (x86)\Kingo ROOT\Kingo Root.exe (Kingosoft)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT\Uninstall Kingo ROOT.lnk -> C:\Program Files (x86)\Kingo ROOT\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Java konfigurieren.lnk -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\javacpl.exe (Oracle Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Filetopia\Filetopia.lnk -> C:\Program Files (x86)\Filetopia3\Filetopia.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Anleitung.lnk -> C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\HelpLauncher.exe (Elaborate Bytes AG)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Uninstall.lnk -> C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\vcd-uninst.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Virtual CloneDrive Revision History.lnk -> C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\changes_vcd.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Virtual CloneDrive.lnk -> C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDPrefs.exe (Elaborate Bytes AG)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepSea Obfuscator 4\DeepSea Obfuscator Help.lnk -> C:\Program Files\DeepSea Obfuscator 4\DeepSea.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepSea Obfuscator 4\DeepSea Obfuscator.lnk -> C:\Program Files\DeepSea Obfuscator 4\DeepSeaUI.exe (TallApplications)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks\Start BlueStacks.lnk -> C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe (BlueStack Systems, Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Antivirus\Avira Antivirus Hilfe.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\57\avwin.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Antivirus\Avira Antivirus starten.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Antivirus\Avira im Internet.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\weblink.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG\AVG 2015.lnk -> C:\Program Files (x86)\AVG\AVG2015\avgui.exe (No File)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Help File.lnk -> C:\Program Files (x86)\AutoIt3\AutoIt.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x64).lnk -> C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x86).lnk -> C:\Program Files (x86)\AutoIt3\Au3Info.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x64).lnk -> C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x86).lnk -> C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Examples.lnk -> C:\Program Files (x86)\AutoIt3\Examples ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x64).lnk -> C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x86).lnk -> C:\Program Files (x86)\AutoIt3\AutoIt3.exe (AutoIt Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\SciTE Script Editor.lnk -> C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe (Neil Hodgson neilh@scintilla.org)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoIt v3 Website.lnk -> C:\Program Files (x86)\AutoIt3\AutoIt v3 Website.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\Browse Extras.lnk -> C:\Program Files (x86)\AutoIt3\Extras ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\AutoItX Help File.lnk -> C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\VBScript Examples.lnk -> C:\Program Files (x86)\AutoIt3\AutoItX\ActiveX\VBScript (No File)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk -> C:\Windows\System32\calc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk -> C:\Windows\System32\displayswitch.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk -> C:\Windows\System32\SoundRecorder.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk -> C:\Windows\System32\mobsync.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk -> C:\Windows\System32\rstrui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk -> C:\Windows\System32\migwiz\PostMig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk -> C:\Windows\System32\migwiz\migwiz.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk -> C:\Program Files\7-Zip\7zFM.exe (Igor Pavlov)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk -> C:\Program Files\7-Zip\7-zip.chm ()
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\Links\Desktop.lnk -> C:\Users\julian\Desktop ()
Shortcut: C:\Users\julian\Links\Downloads.lnk -> C:\Users\julian\Downloads ()
Shortcut: C:\Users\julian\Desktop\BitTorrent.lnk -> C:\Users\julian\AppData\Roaming\BitTorrent\BitTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\Desktop\Filetopia.lnk -> C:\Program Files (x86)\Filetopia3\Filetopia.exe ()
Shortcut: C:\Users\julian\Desktop\JDownloader 2.lnk -> C:\Users\julian\AppData\Local\JDownloader v2.0\JDownloader2.exe (AppWork GmbH)
Shortcut: C:\Users\julian\Desktop\PeerBlock.lnk -> C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
Shortcut: C:\Users\julian\Desktop\Process Hacker 2.lnk -> C:\Program Files\Process Hacker 2\ProcessHacker.exe (wj32)
Shortcut: C:\Users\julian\Desktop\µTorrent.lnk -> C:\Users\julian\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\Desktop\Tor Browser\Start Tor Browser.lnk -> C:\Users\julian\Desktop\Tor Browser\Browser\firefox.exe (Mozilla Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk -> C:\Users\julian\AppData\Roaming\BitTorrent\BitTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk -> C:\Users\julian\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Benutzerhandbuch für die Konsolenversion von RAR.lnk -> C:\Program Files\WinRAR\Rar.txt ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Hilfe zu WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Was ist neu in dieser Version.lnk -> C:\Program Files\WinRAR\WhatsNew.txt ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.exe (Alexander Roshal)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC\DUC.lnk -> C:\Program Files (x86)\No-IP\DUC40.exe ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC\License.lnk -> C:\Program Files (x86)\No-IP\License.txt ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC\Uninstall.lnk -> C:\Program Files (x86)\No-IP\Uninstall.exe ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader\JDownloader 2 Deinstallationsprogramm.lnk -> C:\Users\julian\AppData\Local\JDownloader v2.0\Uninstall JDownloader.exe (AppWork GmbH)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader\JDownloader 2 Update & Rescue.lnk -> C:\Users\julian\AppData\Local\JDownloader v2.0\JDownloader2Update.exe (AppWork GmbH)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader\JDownloader 2.lnk -> C:\Users\julian\AppData\Local\JDownloader v2.0\JDownloader2.exe (AppWork GmbH)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bitcoin Core\Bitcoin Core (64-bit).lnk -> C:\Program Files\Bitcoin\bitcoin-qt.exe ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bitcoin Core\Uninstall Bitcoin Core (64-bit).lnk -> C:\Program Files\Bitcoin\uninstall.exe (Bitcoin Core project)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\EUROTOOL.LNK -> C:\Program Files (x86)\Microsoft Office\OFFICE11\Makro\EUROTOOL.XLA ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Makro.LNK -> C:\Program Files (x86)\Microsoft Office\OFFICE11\Makro ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\Vorlagen.LNK -> C:\Users\julian\AppData\Roaming\Microsoft\Vorlagen ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk -> C:\Users\julian\AppData\Roaming\BitTorrent\BitTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\JDownloader 2.lnk -> C:\Users\julian\AppData\Local\JDownloader v2.0\JDownloader2.exe (AppWork GmbH)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Oracle VM VirtualBox.lnk -> C:\Program Files\Oracle\VirtualBox\VirtualBox.exe ()
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -> C:\Users\julian\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\Users\Public\Desktop\Apps.lnk -> C:\Users\Public\Libraries\Apps.library-ms ()
Shortcut: C:\Users\Public\Desktop\AVG 2015.lnk -> C:\Program Files (x86)\AVG\AVG2015\avgui.exe (No File)
Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Public\Desktop\Kingo ROOT.lnk -> C:\Program Files (x86)\Kingo ROOT\Kingo Root.exe (Kingosoft)
Shortcut: C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation)
Shortcut: C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk -> C:\Program Files\Oracle\VirtualBox\VirtualBox.exe ()
Shortcut: C:\Users\Public\Desktop\Skype.lnk -> C:\Windows\Installer\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\SkypeIcon.exe ()
Shortcut: C:\Users\Public\Desktop\SlimDrivers.lnk -> C:\Windows\Installer\{03E312F7-8697-4BC4-A90F-33D34EECE18C}\Icon.exe ()
Shortcut: C:\Users\Public\Desktop\Start BlueStacks.lnk -> C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe (BlueStack Systems, Inc.)
Shortcut: C:\Users\Public\Desktop\TrueCrypt.lnk -> C:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation)
Shortcut: C:\Users\Public\Desktop\Virtual CloneDrive.lnk -> C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDPrefs.exe (Elaborate Bytes AG)




ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk -> C:\Windows\System32\wuapp.exe (Microsoft Corporation) -> startmenu
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) -> /showgadgets
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Tor\Torrc.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation) -> C:\Users\julian\AppData\Local\Vidalia\torrc
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt\Uninstall TrueCrypt.lnk -> C:\Program Files\TrueCrypt\TrueCrypt Setup.exe (TrueCrypt Foundation) -> /u
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimDrivers\SlimDrivers Help.lnk -> C:\Windows\Installer\{03E312F7-8697-4BC4-A90F-33D34EECE18C}\Icon.exe () -> -help
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Programm mit Sandboxie starten.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> /box:__ask__ run_dialog
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Sandboxie Control.lnk -> C:\Program Files\Sandboxie\SbieCtrl.exe (Sandboxie Holdings, LLC) -> /open
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Sandboxie Deinstallieren.lnk -> C:\Windows\Installer\SandboxieInstall64.exe (Sandboxie Holdings, LLC) -> /remove
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Sandboxie Startmenü.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> /box:__ask__ start_menu
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Webbrowser mit Sandboxie starten.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> default_browser
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie\Windows Explorer mit Sandboxie starten.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> .
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Assistent zum Speichern eigener Einstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\opwicon.exe () -> /u
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Anwendungswiederherstellung.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe () -> -c
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.BackupAndRestore
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Auf Updates prüfen.lnk -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\javacpl.exe (Oracle Corporation) -> -tab update
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Info zu Java.lnk -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\javacpl.exe (Oracle Corporation) -> -tab about
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepSea Obfuscator 4\Check for updates.lnk -> C:\Program Files\Common Files\TallApplications\Update\TallApplications.Update.exe (TallApplications) -> /title DeepSea Obfuscator v4 (Licensed) Updater
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira.lnk -> C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) -> /showMiniGui
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Check For Updates.lnk -> C:\Program Files (x86)\AutoIt3\AutoIt3.exe (AutoIt Team) -> "C:\Program Files (x86)\AutoIt3\Extras\AutoUpdateIt\AutoUpdateIt.au3"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation) -> -NoExit -ImportSystemModules
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation) -> /open
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> %SystemRoot%\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX
ShortcutWithArgument: C:\ProgramData\BlueStacks\UserData\Library\My Apps\Help.lnk -> C:\Program Files (x86)\BlueStacks\HD-RunApp.exe (BlueStack Systems, Inc.) -> -p com.bluestacks.help -a com.bluestacks.help.HelpActivity
ShortcutWithArgument: C:\ProgramData\BlueStacks\UserData\Library\App Stores\1Mobile Market.lnk -> C:\Program Files (x86)\BlueStacks\HD-RunApp.exe (BlueStack Systems, Inc.) -> -p me.onemobile.android -a me.onemobile.android.MainPagerActivity
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\julian\Desktop\Sandboxed Web Browser.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> default_browser
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Filetopia\Uninstall Filetopia Client v3.04.lnk -> C:\Program Files (x86)\Filetopia3\UNWISE.EXE () -> C:\PROGRA~2\FILETO~1\INSTALL.LOG
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) ->  -extoff
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\SendTo\Sandboxie - DefaultBox.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> /box:DefaultBox
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Windows\SendTo\Skype.lnk -> C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.) -> /sendto:
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook starten.lnk -> C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation) ->  /recycle
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Sandboxed Web Browser.lnk -> C:\Program Files\Sandboxie\Start.exe (Sandboxie Holdings, LLC) -> default_browser
ShortcutWithArgument: C:\Users\julian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\Users\julian\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Auto0Shutdown0Restyled0Pierre.gadget\core\hibernation.lnk -> C:\Windows\System32\shutdown.exe (Microsoft Corporation) -> -h -f
ShortcutWithArgument: C:\Users\julian\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Auto0Shutdown0Restyled0Pierre.gadget\core\logoff.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> user32.dll, LockWorkStation
ShortcutWithArgument: C:\Users\julian\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Auto0Shutdown0Restyled0Pierre.gadget\core\restart.lnk -> C:\Windows\System32\shutdown.exe (Microsoft Corporation) -> -r -f -t 01
ShortcutWithArgument: C:\Users\julian\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Auto0Shutdown0Restyled0Pierre.gadget\core\shutdown.lnk -> C:\Windows\System32\shutdown.exe (Microsoft Corporation) -> -s -f -t 01
ShortcutWithArgument: C:\Users\Public\Desktop\Avira.lnk -> C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) -> /showMiniGui


InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt\TrueCrypt Website.url -> hxxp://www.truecrypt.org/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2\Help and Support\Process Hacker 2 on the Web.url -> hxxp://processhacker.sourceforge.net/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\Help and Support\Forums.url -> hxxp://forums.peerblock.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\Help and Support\Homepage.url -> hxxp://www.peerblock.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock\Help and Support\User Manual.url -> hxxp://www.peerblock.com/userguide
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT\Kingo ROOT on the Web.url -> hxxp://www.kingoapp.com/
InternetURL: C:\Users\julian\Favorites\Windows Live\Windows Live Gallery.url -> hxxp://go.microsoft.com/fwlink/?LinkId=70742
InternetURL: C:\Users\julian\Favorites\Windows Live\Windows Live Ideas.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72700
InternetURL: C:\Users\julian\Favorites\Windows Live\Windows Live Mail.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72681
InternetURL: C:\Users\julian\Favorites\Windows Live\Windows Live Spaces.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72682
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN Auto.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72680
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN Fernsehen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72659
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN Money.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72640
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN Nachrichten.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72636
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN Sport.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72635
InternetURL: C:\Users\julian\Favorites\MSN-Websites\MSN.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72630
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\IE-Site auf Microsoft.com.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72186
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Microsoft Deutschland GmbH.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72520
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Microsoft Store.url -> hxxp://go.microsoft.com/fwlink/?linkid=140813
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Microsoft Windows - Start.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72629
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Microsoft zu Hause.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72406
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Microsoft.com durchsuchen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72893
InternetURL: C:\Users\julian\Favorites\Microsoft-Websites\Site für IE Add-Ons.url -> hxxp://go.microsoft.com/fwlink/?LinkId=50893
InternetURL: C:\Users\julian\Favorites\Links\Vorgeschlagene Sites.url -> https://ieonline.microsoft.com/#ieslice
InternetURL: C:\Users\julian\Favorites\Links\Web Slice-Katalog.url -> hxxp://go.microsoft.com/fwlink/?LinkId=121315

==================== End of log =============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by julian at 2015-04-01 10:21:15
Running from C:\Users\julian\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\uTorrent) (Version: 3.4.2.39710 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
AutoIt v3.3.12.0 (HKLM-x32\...\AutoItv3) (Version: 3.3.12.0 - AutoIt Team)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5751 - AVG Technologies)
AVG 2015 (Version: 15.0.4315 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5751 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bitcoin Core (64-bit) (HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Bitcoin Core (64-bit)) (Version: 0.10.0 - Bitcoin Core project)
BitTorrent (HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\BitTorrent) (Version: 7.9.2.38914 - BitTorrent Inc.)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.9.14.4604 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{01961AE4-2F93-408B-AAED-AC582C4F5059}) (Version: 0.9.14.4604 - BlueStack Systems, Inc.)
DeepSea Obfuscator v4 (Licensed) (4.4.4.86) (HKLM\...\0222D721-97AC-49E8-9127-EA65AD781F85_is1) (Version: 4.4.4.86 - TallApplications)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Filetopia Client v3.04 (HKLM-x32\...\Filetopia Client v3.04) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HashTab 5.2.0.14 (HKLM\...\HashTab) (Version: 5.2.0.14 - Implbits Software)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2993 - Intel Corporation)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kingo ROOT version 1.3.4.2252 (HKLM-x32\...\{AE7675D6-0B31-494F-ABFA-822E1A0FDF17}_is1) (Version: 1.3.4.2252 - Kingosoft Technology Ltd.)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.7969.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.1.0 - Vitalwerks Internet Solutions LLC)
Oracle VM VirtualBox 4.3.24 (HKLM\...\{15E093DF-951E-46CB-B3EC-E1287E7A2319}) (Version: 4.3.24 - Oracle Corporation)
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
Process Hacker 2.33 (r5590) (HKLM\...\Process_Hacker2_is1) (Version: 2.33.0.5590 - wj32)
Resource Hacker Version 3.6.0 (HKLM-x32\...\ResourceHacker_is1) (Version:  - )
Sandboxie 4.16 (64-bit) (HKLM\...\Sandboxie) (Version: 4.16 - Sandboxie Holdings, LLC)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
SlimDrivers (HKLM-x32\...\{03E312F7-8697-4BC4-A90F-33D34EECE18C}) (Version: 2.2.44488 - SlimWare Utilities, Inc.)
Tor 0.2.4.23 (HKLM-x32\...\Tor) (Version:  - )
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Vidalia 0.2.21 (HKLM-x32\...\Vidalia) (Version:  - )
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3484087542-3240090288-3349016086-1000_Classes\CLSID\{01E9FAE9-3819-4dd9-B1D9-998A1C62D1F8}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3484087542-3240090288-3349016086-1000_Classes\CLSID\{25815CC0-43F4-3C75-8C3A-A139D9ADE740}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Restore Points  =========================

01-04-2015 10:19:15 Windows 7 Service Pack 1

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-03-28 20:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {26A12C05-C1FE-47A2-9B19-64B79D9C0F60} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-27] (Google Inc.)
Task: {6C9AC9D4-9621-4067-A6E5-D86F89A14564} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-27] (Google Inc.)
Task: {E93AC64D-E885-4A8F-996D-4D412331EB36} - System32\Tasks\SlimDrivers Startup => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe [2015-01-28] (SlimWare Utilities, Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) ==============

2015-02-27 21:13 - 2000-01-01 02:00 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-03-03 19:46 - 2015-03-03 19:46 - 00004096 _____ () C:\Users\julian\AppData\Local\Microsoft\Windows Sidebar\Gadgets\TechnoBaseFM.Gadget\TechnoBaseFMGadget.dll
2010-06-07 01:07 - 2015-03-14 12:12 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
2010-06-07 01:07 - 2015-03-14 12:12 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
2010-06-07 01:07 - 2015-03-14 12:12 - 09278792 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\julian\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^julian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^7ca6a7fec2df0d82a777ae67fbedc9eb.exe => C:\Windows\pss\7ca6a7fec2df0d82a777ae67fbedc9eb.exe.Startup
MSCONFIG\startupreg: 7ca6a7fec2df0d82a777ae67fbedc9eb => "C:\Users\julian\AppData\Local\Temp\explorer.exe" ..

==================== Accounts: =============================

Administrator (S-1-5-21-3484087542-3240090288-3349016086-500 - Administrator - Disabled)
Gast (S-1-5-21-3484087542-3240090288-3349016086-501 - Limited - Disabled)
julian (S-1-5-21-3484087542-3240090288-3349016086-1000 - Administrator - Enabled) => C:\Users\julian

==================== Faulty Device Manager Devices =============

Name: PS/2-kompatible Maus
Description: PS/2-kompatible Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/31/2015 10:41:35 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={E227D3A1-89A5-42E9-883D-4E7193DE7BD7}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.

Error: (03/31/2015 10:41:33 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={96478773-C163-43D3-B4C1-AA6B9E5466A2}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 691.

Error: (03/31/2015 10:41:20 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={D451D283-34D3-4C62-8ED5-E6C30DDC7CEE}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 691.

Error: (03/31/2015 10:40:46 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={7D193E79-4954-4F2F-AC28-B016D27661C8}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 734.

Error: (03/31/2015 10:38:53 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={D9BF214A-AFFA-4149-9AA9-3403B6A75B42}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.

Error: (03/31/2015 10:38:44 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={E54CCE66-753A-4E0C-AC3A-A98172982FCB}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 734.

Error: (03/31/2015 10:38:23 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={512F3A55-CBC2-4BEB-B55F-4383CE1F9492}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 691.

Error: (03/31/2015 10:38:19 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={11280F73-0F93-4E8C-BE0A-F360A6BA8160}: Der Benutzer "julian-PC\julian" hat eine Verbindung mit dem Namen "VPN-Verbindung" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 691.

Error: (06/07/2010 00:05:25 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (06/07/2010 00:05:25 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.


System errors:
=============
Error: (04/01/2015 10:11:03 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.

Error: (03/31/2015 10:40:46 PM) (Source: RasMan) (EventID: 20276) (User: )
Description: CoID={7D193E79-4954-4F2F-AC28-B016D27661C8}: Ebene=PPP: Unterebene=LCP: Der Verbindungsversuch an Port "VPN0-1" ist aufgrund des ausgewählten Authentifizierungsprotokolls gescheitert. Überprüfen Sie, ob das Authentifizierungsprotokoll unter den Betriebssystemen an den Client- und Serverenden der Verbindung unterstützt wird.

Error: (03/31/2015 10:38:44 PM) (Source: RasMan) (EventID: 20276) (User: )
Description: CoID={E54CCE66-753A-4E0C-AC3A-A98172982FCB}: Ebene=PPP: Unterebene=LCP: Der Verbindungsversuch an Port "VPN0-1" ist aufgrund des ausgewählten Authentifizierungsprotokolls gescheitert. Überprüfen Sie, ob das Authentifizierungsprotokoll unter den Betriebssystemen an den Client- und Serverenden der Verbindung unterstützt wird.

Error: (06/07/2010 00:04:23 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (06/07/2010 00:02:48 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (06/07/2010 00:02:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (03/31/2015 06:19:21 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 
%%1064

Error: (03/31/2015 06:17:54 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (03/31/2015 01:39:01 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 
%%16405

Error: (03/31/2015 01:38:15 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.


Microsoft Office Sessions:
=========================
Error: (03/31/2015 10:41:35 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {E227D3A1-89A5-42E9-883D-4E7193DE7BD7}julian-PC\julianVPN-Verbindung0

Error: (03/31/2015 10:41:33 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {96478773-C163-43D3-B4C1-AA6B9E5466A2}julian-PC\julianVPN-Verbindung691

Error: (03/31/2015 10:41:20 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {D451D283-34D3-4C62-8ED5-E6C30DDC7CEE}julian-PC\julianVPN-Verbindung691

Error: (03/31/2015 10:40:46 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {7D193E79-4954-4F2F-AC28-B016D27661C8}julian-PC\julianVPN-Verbindung734

Error: (03/31/2015 10:38:53 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {D9BF214A-AFFA-4149-9AA9-3403B6A75B42}julian-PC\julianVPN-Verbindung0

Error: (03/31/2015 10:38:44 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {E54CCE66-753A-4E0C-AC3A-A98172982FCB}julian-PC\julianVPN-Verbindung734

Error: (03/31/2015 10:38:23 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {512F3A55-CBC2-4BEB-B55F-4383CE1F9492}julian-PC\julianVPN-Verbindung691

Error: (03/31/2015 10:38:19 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {11280F73-0F93-4E8C-BE0A-F360A6BA8160}julian-PC\julianVPN-Verbindung691

Error: (06/07/2010 00:05:25 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (06/07/2010 00:05:25 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU M 380 @ 2.53GHz
Percentage of memory in use: 48%
Total physical RAM: 3892.52 MB
Available physical RAM: 1988.87 MB
Total Pagefile: 7783.19 MB
Available Pagefile: 5406.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.07 GB) (Free:185.69 GB) NTFS
Drive f: (Backup) (Fixed) (Total:97.66 GB) (Free:76.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 0008D427)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by julian (administrator) on JULIAN-PC on 01-04-2015 10:13:28
Running from C:\Users\julian\Desktop
Loaded Profiles: julian (Available profiles: julian)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\update.exe
(Avira Operations GmbH & Co. KG) C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\updrgui.exe
(Farbar) C:\Users\julian\Desktop\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-02-10] (Oracle Corporation)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [855768 2015-02-19] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-17] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [BitTorrent] => C:\Users\julian\AppData\Roaming\BitTorrent\BitTorrent.exe [1744472 2015-02-27] (BitTorrent Inc.)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [uTorrent] => C:\Users\julian\AppData\Roaming\uTorrent\uTorrent.exe [1442384 2015-03-26] (BitTorrent Inc.)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [785416 2015-02-18] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2015-03-10] (TrueCrypt Foundation)
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\...\Run: [Vidalia] => C:\Program Files (x86)\Vidalia Bridge Bundle\Vidalia\vidalia.exe [6239727 2014-07-29] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3484087542-3240090288-3349016086-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-07] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\julian\AppData\Roaming\Mozilla\Firefox\Profiles\qeCXqXKr.default
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-07] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-27] (Google Inc.)
FF Extension: Avira Browser Safety - C:\Users\julian\AppData\Roaming\Mozilla\Firefox\Profiles\qeCXqXKr.default\Extensions\abs@avira.com [2015-03-24]

Chrome: 
=======
CHR Profile: C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-27]
CHR Extension: (Google Docs) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-27]
CHR Extension: (Google Drive) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-27]
CHR Extension: (YouTube) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-27]
CHR Extension: (Google Search) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-27]
CHR Extension: (Google Sheets) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-27]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-27]
CHR Extension: (WebRTC Block) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nphkkbaidamjmhfanlpblblcadhfbkdm [2015-03-03]
CHR Extension: (Gmail) - C:\Users\julian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-27]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-17] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [409304 2015-02-19] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [388824 2015-02-19] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [794328 2015-02-19] (BlueStack Systems, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [175112 2015-02-18] (Sandboxie Holdings, LLC)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [270816 2015-02-19] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-01-23] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-01-16] (AVG Technologies CZ, s.r.o.)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2015-02-19] (BlueStack Systems)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [107736 2015-03-26] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 Rockusb; C:\Windows\System32\DRIVERS\rockusb.sys [68456 2014-08-11] (Fuzhou Rockchip Electronics Co,Ltd.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [237064 2015-02-18] (Sandboxie Holdings, LLC)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13920 2015-03-24] ()
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [116744 2015-03-02] (Oracle Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-01 10:18 - 2015-04-01 10:18 - 00000000 ____D () C:\Windows\system32\EventProviders
2015-04-01 10:18 - 2015-04-01 10:18 - 00000000 ____D () C:\037fa67ec75762724e8a4c79
2015-03-31 22:36 - 2015-03-31 22:36 - 00030781 _____ () C:\Users\julian\Downloads\ubuntu-12.04.5-alternate-amd64.iso.torrent
2015-03-31 22:35 - 2015-03-31 22:35 - 00215716 _____ () C:\Users\julian\Downloads\bootstrap.dat (3).torrent
2015-03-31 19:20 - 2015-03-31 19:20 - 00215716 _____ () C:\Users\julian\Downloads\bootstrap.dat (2).torrent
2015-03-31 18:57 - 2015-03-31 18:57 - 00000043 _____ () C:\Users\julian\Desktop\youtube.txt
2015-03-31 14:57 - 2015-03-31 14:57 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2015-03-31 14:57 - 2015-03-31 14:57 - 00000000 ____D () C:\usb_driver
2015-03-31 14:44 - 2015-03-31 14:44 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WinUSBCoInstaller.dll
2015-03-31 14:43 - 2015-03-31 14:44 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01007.dll
2015-03-31 14:39 - 2015-03-31 14:39 - 00942984 _____ () C:\Users\julian\Downloads\cminstaller-win-beta.exe
2015-03-31 14:33 - 2015-03-31 14:33 - 02272656 _____ () C:\Users\julian\Downloads\i9300XXUGNG3_root_bitstopfen_3tlg.zip.part
2015-03-31 14:22 - 2015-03-31 14:22 - 00215716 _____ () C:\Users\julian\Downloads\bootstrap.dat (1).torrent
2015-03-30 22:40 - 2015-03-30 22:40 - 00215716 _____ () C:\Users\julian\Downloads\bootstrap.dat.torrent
2015-03-30 22:05 - 2015-03-31 19:18 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Bitcoin
2015-03-30 22:04 - 2015-03-30 22:04 - 12267264 _____ (Bitcoin Core project) C:\Users\julian\Downloads\bitcoin-0.10.0-win64-setup.exe
2015-03-30 22:04 - 2015-03-30 22:04 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bitcoin Core
2015-03-30 22:04 - 2015-03-30 22:04 - 00000000 ____D () C:\Program Files\Bitcoin
2015-03-30 22:01 - 2015-03-30 22:01 - 00013279 _____ () C:\Users\julian\Downloads\bitcoin-0.10.0.torrent
2015-03-30 21:59 - 2015-03-30 22:05 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-30 21:58 - 2015-02-26 21:14 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-30 21:38 - 2014-09-15 02:44 - 03195392 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-30 21:38 - 2011-04-09 08:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-03-30 21:38 - 2011-04-09 08:45 - 05509504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-30 21:38 - 2011-04-09 08:13 - 03957632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-30 21:38 - 2011-04-09 08:13 - 03901824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-30 21:38 - 2011-04-09 07:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-03-30 21:33 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-03-30 21:33 - 2012-06-03 00:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-03-30 21:33 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-03-30 21:33 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-03-30 21:33 - 2012-06-03 00:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-03-30 21:33 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-03-30 21:33 - 2012-06-03 00:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-03-30 21:33 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-03-30 21:33 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-03-30 13:12 - 2015-03-30 13:12 - 00019843 _____ () C:\Users\julian\Desktop\proxies 30.03.txt
2015-03-29 20:33 - 2015-03-29 20:33 - 00852604 _____ () C:\Users\julian\Downloads\SecurityCheck.exe
2015-03-29 19:12 - 2015-03-29 19:12 - 02347384 _____ (ESET) C:\Users\julian\Desktop\esetsmartinstaller_deu.exe
2015-03-29 19:12 - 2015-03-29 19:12 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-29 19:11 - 2015-03-29 19:12 - 02347384 _____ (ESET) C:\Users\julian\Downloads\esetsmartinstaller_deu.exe
2015-03-29 14:05 - 2015-03-29 14:07 - 25728853 ____R () C:\Users\julian\Downloads\WPA-PSK WORDLIST 2 (107 MB).rar
2015-03-29 14:05 - 2015-03-29 14:07 - 09766944 ____R () C:\Users\julian\Downloads\WPA-PSK WORDLIST (40 MB).rar
2015-03-29 14:01 - 2012-06-21 14:49 - 900000000 _____ () C:\Users\julian\Desktop\8Digit.lst
2015-03-29 14:00 - 2015-03-29 14:01 - 04293377 _____ () C:\Users\julian\Downloads\8Digit.rar
2015-03-29 13:58 - 2015-03-29 13:58 - 00000000 ____D () C:\Users\julian\Downloads\Tor Browser Windows 3.6.2 Unblock Any WebSite  GOPI SAHI @ SilverRG
2015-03-29 13:47 - 2015-03-29 13:47 - 00040180 _____ () C:\Users\julian\Downloads\ubuntu-14.04.2-desktop-amd64.iso (1).torrent
2015-03-29 12:50 - 2015-03-29 12:51 - 31094527 ____R (Igor Pavlov) C:\Users\julian\Downloads\PirateBrowser_0.6b.exe
2015-03-29 12:00 - 2015-03-29 12:00 - 00001354 _____ () C:\Users\julian\Desktop\JRT.txt
2015-03-29 11:52 - 2015-03-29 11:52 - 01389240 _____ (Thisisu) C:\Users\julian\Downloads\JRT.exe
2015-03-29 11:52 - 2015-03-29 11:52 - 01389240 _____ (Thisisu) C:\Users\julian\Desktop\JRT.exe
2015-03-29 11:49 - 2015-03-29 11:49 - 00002103 _____ () C:\Users\julian\Desktop\AdwCleaner[S0].txt
2015-03-29 11:44 - 2015-03-29 11:47 - 00000000 ____D () C:\AdwCleaner
2015-03-29 11:44 - 2015-03-29 11:44 - 02168320 _____ () C:\Users\julian\Downloads\AdwCleaner_4.113.exe
2015-03-29 11:44 - 2015-03-29 11:44 - 02168320 _____ () C:\Users\julian\Desktop\AdwCleaner_4.113.exe
2015-03-29 11:41 - 2015-03-29 11:41 - 00001732 _____ () C:\Users\julian\Desktop\mbam#.txt
2015-03-29 11:15 - 2015-03-29 11:15 - 00001854 _____ () C:\Users\julian\Desktop\bericht.txt
2015-03-29 11:15 - 2015-03-29 11:15 - 00000951 _____ () C:\Users\julian\Desktop\BlueScreenView.cfg
2015-03-29 11:14 - 2015-03-29 11:14 - 00067310 _____ () C:\Users\julian\Downloads\bluescreenview_v1.55.zip
2015-03-29 11:14 - 2015-01-29 11:11 - 00061024 _____ (NirSoft) C:\Users\julian\Desktop\BlueScreenView.exe
2015-03-28 20:31 - 2015-03-28 20:31 - 00022251 _____ () C:\ComboFix.txt
2015-03-28 20:12 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-28 20:12 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-28 20:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-28 20:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-28 20:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-28 20:12 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-28 20:12 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-28 20:12 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-28 20:11 - 2015-03-28 20:31 - 00000000 ____D () C:\Qoobox
2015-03-28 20:11 - 2015-03-28 20:29 - 00000000 ____D () C:\Windows\erdnt
2015-03-28 20:10 - 2015-03-28 20:10 - 05615749 ____R (Swearware) C:\Users\julian\Desktop\ComboFix.exe
2015-03-28 20:10 - 2015-03-28 20:10 - 05615749 _____ (Swearware) C:\Users\julian\Downloads\ComboFix.exe
2015-03-28 20:05 - 2015-03-28 20:05 - 00262144 _____ () C:\Windows\Minidump\032815-27487-01.dmp
2015-03-28 14:08 - 2015-03-28 14:08 - 00000195 ____R () C:\Users\julian\Downloads\proxies.txt
2015-03-26 21:07 - 2015-03-26 21:07 - 00000887 _____ () C:\Users\julian\Downloads\Opencellid - measurements of 262-3-40068-135575806 (size 1).kml
2015-03-26 21:07 - 2015-03-26 21:07 - 00000262 _____ () C:\Users\julian\Downloads\Opencellid - measurements of 262-3-40068-135575806 (size 1).csv
2015-03-26 17:05 - 2015-03-26 17:27 - 647823360 _____ () C:\Users\julian\Downloads\Windows_XP_Professional_SP3_Nov_2013_Incl_SATA_Drivers.iso
2015-03-26 14:06 - 2015-03-26 14:06 - 00000400 _____ () C:\Windows\ODBC.INI
2015-03-26 14:05 - 2015-03-26 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-03-26 14:03 - 2015-03-26 14:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2015-03-26 14:03 - 2015-03-26 14:03 - 00000000 ____D () C:\Windows\PCHEALTH
2015-03-26 13:01 - 2015-03-26 13:01 - 00000000 ____D () C:\Users\julian\Downloads\Microsoft Office Pro 2003 11.8411.8405 SP3 RePack by D!akov
2015-03-26 12:49 - 2015-03-26 14:01 - 00000000 ____D () C:\Users\julian\Downloads\MS Off 03 pandora
2015-03-26 12:17 - 2009-07-14 03:39 - 00000028 _____ () C:\Windows\Systems.ini
2015-03-26 10:11 - 2015-03-26 10:11 - 00003296 ____N () C:\bootsqm.dat
2015-03-25 22:13 - 2015-03-25 22:14 - 00000000 ____D () C:\Users\julian\Downloads\Adolf Hitler Paintings
2015-03-25 21:23 - 2015-03-25 21:23 - 00000000 ____D () C:\Users\julian\AppData\Local\Tor
2015-03-25 21:23 - 2010-06-07 00:05 - 00000000 ____D () C:\Users\julian\AppData\Local\Vidalia
2015-03-25 21:05 - 2015-03-26 12:19 - 00000000 ____D () C:\Program Files (x86)\Filetopia3
2015-03-25 21:05 - 2015-03-25 21:05 - 00000962 _____ () C:\Users\julian\Desktop\Filetopia.lnk
2015-03-25 21:05 - 2015-03-25 21:05 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Filetopia
2015-03-25 21:05 - 2015-03-25 21:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Filetopia
2015-03-25 21:04 - 2015-03-25 21:04 - 01842176 _____ () C:\Users\julian\Downloads\ftop3.exe
2015-03-25 20:55 - 2015-03-25 20:56 - 00000000 ____D () C:\Users\julian\Downloads\MUTE
2015-03-25 20:55 - 2015-03-25 20:55 - 04639202 _____ () C:\Users\julian\Downloads\MUTE_fileSharing-0.5.1_Windows.exe
2015-03-25 19:35 - 2015-03-25 19:35 - 09378598 _____ () C:\Users\julian\Downloads\vidalia-bridge-bundle-0.2.4.23-0.2.21 (1).exe
2015-03-25 12:58 - 2015-03-25 12:58 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\julian\Downloads\tdsskiller44 (1).exe
2015-03-25 12:58 - 2015-03-25 12:58 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\julian\Desktop\tdsskiller44 (1).exe
2015-03-25 12:19 - 2015-03-26 13:48 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-25 12:18 - 2015-03-26 13:48 - 00000000 ____D () C:\Users\julian\Desktop\mbar
2015-03-25 12:18 - 2015-03-25 12:18 - 16502728 _____ (Malwarebytes Corp.) C:\Users\julian\Downloads\mbar-1.09.1.1004 (1).exe
2015-03-25 12:18 - 2015-03-25 12:18 - 16502728 _____ (Malwarebytes Corp.) C:\Users\julian\Desktop\mbar-1.09.1.1004 (1).exe
2015-03-25 12:16 - 2015-03-25 12:17 - 16502728 _____ (Malwarebytes Corp.) C:\Users\julian\Downloads\mbar-1.09.1.1004.exe
2015-03-24 15:17 - 2015-03-30 11:25 - 00043146 _____ () C:\Users\julian\Desktop\Shortcut.txt
2015-03-24 15:15 - 2015-03-30 11:25 - 00025203 _____ () C:\Users\julian\Desktop\Addition.txt
2015-03-24 15:14 - 2015-04-01 10:18 - 00012229 _____ () C:\Users\julian\Desktop\FRST.txt
2015-03-24 15:13 - 2015-04-01 10:17 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Avira
2015-03-24 15:08 - 2015-03-24 15:08 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Mozilla
2015-03-24 15:06 - 2015-03-17 14:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-24 15:06 - 2015-03-17 14:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-24 15:06 - 2015-03-17 14:01 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-24 15:06 - 2015-03-17 14:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-03-24 15:01 - 2015-04-01 10:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-24 15:01 - 2015-04-01 10:15 - 00000000 ____D () C:\ProgramData\Avira
2015-03-24 15:01 - 2015-03-24 15:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-24 15:01 - 2015-03-24 15:01 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-03-24 15:00 - 2015-03-24 15:00 - 04515896 _____ (Avira Operations & Co. KG) C:\Users\julian\Downloads\avira_de_av_55115fdd78351__wsm.exe
2015-03-24 15:00 - 2015-03-24 15:00 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-24 13:52 - 2015-03-24 13:52 - 02095616 _____ (Farbar) C:\Users\julian\Desktop\FRST64 (1).exe
2015-03-24 13:51 - 2015-03-24 13:52 - 02095616 _____ (Farbar) C:\Users\julian\Downloads\FRST64 (1).exe
2015-03-24 13:43 - 2015-03-24 13:44 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\julian\Downloads\tdsskiller44.exe
2015-03-24 13:39 - 2015-03-31 22:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-24 13:38 - 2015-03-26 10:21 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-24 13:38 - 2015-03-24 13:38 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-24 13:38 - 2015-03-24 13:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-24 13:38 - 2015-03-24 13:38 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-24 13:38 - 2015-03-24 13:38 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-24 13:38 - 2015-03-17 07:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-24 13:38 - 2015-03-17 07:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-24 13:37 - 2015-03-24 13:38 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\julian\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-24 13:36 - 2015-03-25 12:51 - 00000000 ___HD () C:\ProgramData\{$1284-9213-2940-1289$}
2015-03-24 13:36 - 2015-03-24 13:36 - 00000000 _____ () C:\Users\julian\AppData\Roaming\system.ini
2015-03-24 13:09 - 2015-03-25 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle
2015-03-24 13:09 - 2015-03-25 21:23 - 00000000 ____D () C:\Program Files (x86)\Vidalia Bridge Bundle
2015-03-24 13:08 - 2015-03-24 13:09 - 09378598 _____ () C:\Users\julian\Downloads\vidalia-bridge-bundle-0.2.4.23-0.2.21.exe
2015-03-24 13:04 - 2010-06-07 00:05 - 00000000 ____D () C:\Users\julian\AppData\Roaming\tor
2015-03-24 12:49 - 2015-03-24 12:49 - 00000000 ____D () C:\Users\julian\Desktop\Tor Browser
2015-03-24 12:48 - 2015-03-24 12:49 - 34737321 _____ () C:\Users\julian\Downloads\torbrowser-install-4.0.5_de.exe
2015-03-24 12:10 - 2015-03-24 12:18 - 00000000 ____D () C:\Users\julian\Downloads\40 Textures Wallpapers 1920x1200 Px [Set 5]
2015-03-24 12:07 - 2015-03-24 12:08 - 00000000 ____D () C:\Users\julian\Downloads\40 Cityscapes Wallpapers 2560x1600 [Set 1]
2015-03-23 17:42 - 2015-03-23 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3
2015-03-23 17:42 - 2015-03-23 17:42 - 00000000 ____D () C:\Program Files (x86)\AutoIt3
2015-03-23 17:41 - 2015-03-23 17:41 - 11878040 _____ (AutoIt Team) C:\Users\julian\Downloads\autoit-v3-setup.exe
2015-03-23 17:26 - 2015-03-23 17:26 - 00000030 _____ () C:\Users\julian\Desktop\ico.rc
2015-03-23 17:23 - 2015-03-23 17:23 - 00461798 _____ () C:\Users\julian\Downloads\BosonCrypter Free V2.zip
2015-03-22 20:04 - 2015-03-22 20:05 - 00000000 ____D () C:\Users\julian\Downloads\40 Macro Wallpapers 1920x1200 [Set 43]
2015-03-22 19:34 - 2015-03-22 19:34 - 00002414 _____ () C:\Users\julian\Documents\DeepSea.log
2015-03-22 19:31 - 2015-03-22 19:31 - 00000000 ____D () C:\Users\julian\Documents\DeepSea Obfuscator v4 (Licensed) Samples
2015-03-22 19:31 - 2015-03-22 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DeepSea Obfuscator 4
2015-03-22 19:31 - 2015-03-22 19:31 - 00000000 ____D () C:\Program Files\DeepSea Obfuscator 4
2015-03-22 19:31 - 2015-03-22 19:31 - 00000000 ____D () C:\Program Files\Common Files\TallApplications
2015-03-22 19:30 - 2015-03-22 19:31 - 05608968 _____ (TallApplications ) C:\Users\julian\Downloads\DeepSeaSetup.exe
2015-03-22 19:03 - 2015-03-22 19:03 - 00571466 _____ () C:\Users\julian\Downloads\Call Crypter Refud ByRoda.rar
2015-03-22 18:45 - 2015-03-22 18:45 - 04770164 _____ () C:\Users\julian\Downloads\DarkCometRAT3.0.1.rar
2015-03-22 18:37 - 2015-03-22 18:37 - 00000000 ____D () C:\Users\julian\Downloads\Malwarebytes AntiMalware Premium v2.0.2.1012 ML Incl Keygen-BRD [TorDigger]
2015-03-21 12:23 - 2015-03-26 14:28 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-03-21 12:22 - 2015-03-21 12:22 - 07824680 _____ (TeamViewer GmbH) C:\Users\julian\Downloads\TeamViewer_Setup_de.exe
2015-03-20 20:44 - 2015-03-20 21:25 - 1549615104 _____ () C:\Users\julian\Downloads\linuxmint-17.1-cinnamon-64bit.iso
2015-03-20 20:13 - 2015-03-20 20:31 - 1297121280 _____ () C:\Users\julian\Downloads\debian-live-7.8.0-amd64-kde-desktop.iso
2015-03-20 19:41 - 2015-03-20 19:41 - 00000000 ____D () C:\Neuer Ordner
2015-03-20 19:40 - 2015-03-20 19:40 - 09630677 _____ () C:\Users\julian\Downloads\Oma_DriverAssistant_3.7z
2015-03-20 19:34 - 2015-03-20 19:34 - 00000320 _____ () C:\DriverInstall2015-03-20.txt
2015-03-20 19:26 - 2015-03-20 19:26 - 00000473 _____ () C:\Users\julian\Downloads\CrewRKTablets_RK31_KK_Omni_parameter_8GB_tabs.7z
2015-03-20 19:26 - 2015-03-20 19:26 - 00000460 _____ () C:\Users\julian\Downloads\CrewRKTablets_RK31_KK_Omni_parameter_dynamic.7z
2015-03-20 19:26 - 2014-08-21 20:22 - 00000609 _____ () C:\Users\julian\Desktop\parameter
2015-03-20 19:26 - 2014-06-01 20:36 - 00000609 _____ () C:\Users\julian\Desktop\parameter_8GB
2015-03-20 19:18 - 2015-03-20 19:18 - 00031742 _____ () C:\Users\julian\Downloads\Shortcut.txt
2015-03-20 19:17 - 2015-03-20 19:18 - 00020571 _____ () C:\Users\julian\Downloads\Addition.txt
2015-03-20 19:16 - 2015-04-01 10:13 - 00000000 ____D () C:\FRST
2015-03-20 19:16 - 2015-03-20 19:18 - 00053712 _____ () C:\Users\julian\Downloads\FRST.txt
2015-03-20 19:16 - 2015-03-20 19:16 - 02095616 _____ (Farbar) C:\Users\julian\Downloads\FRST64.exe
2015-03-20 19:10 - 2015-03-20 19:11 - 02721569 _____ () C:\Users\julian\Downloads\RK31_kernel_3036_tab89_tolino.7z
2015-03-20 18:34 - 2015-03-20 18:34 - 01496626 _____ () C:\Users\julian\Downloads\flash_tool_1.5.zip
2015-03-19 19:51 - 2015-03-19 19:51 - 00001534 _____ () C:\Users\julian\Downloads\Opencellid - measurements of 262-1-41817-31 (size 2).kml
2015-03-19 19:51 - 2015-03-19 19:51 - 00000337 _____ () C:\Users\julian\Downloads\Opencellid - measurements of 262-1-41817-31 (size 2).csv
2015-03-18 21:14 - 2015-03-18 21:14 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Process Hacker 2
2015-03-18 21:13 - 2015-03-18 22:00 - 00001885 _____ () C:\Users\julian\Desktop\Process Hacker 2.lnk
2015-03-18 21:13 - 2015-03-18 21:13 - 01932448 _____ (wj32 ) C:\Users\julian\Downloads\processhacker-2.33-setup.exe
2015-03-18 21:13 - 2015-03-18 21:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Process Hacker 2
2015-03-18 21:13 - 2015-03-18 21:13 - 00000000 ____D () C:\Program Files\Process Hacker 2
2015-03-18 20:47 - 2015-03-18 20:48 - 00000000 ____D () C:\Users\julian\Downloads\Desktop Wallpapers - Miscellaneous [1680x1050-2560x1600]-2015
2015-03-18 20:40 - 2015-03-23 16:43 - 00014058 _____ () C:\Users\julian\Desktop\proxies.txt
2015-03-17 17:37 - 2015-03-17 17:37 - 00000000 ____D () C:\Users\julian\Desktop\RK Rom Dumper and Flasher for Windows
2015-03-17 17:36 - 2015-03-17 17:37 - 01253619 _____ () C:\Users\julian\Downloads\rk_tool21_how_to.zip
2015-03-17 17:36 - 2014-08-11 09:59 - 00000000 ____D () C:\Users\julian\Desktop\Release_DriverAssitant
2015-03-17 17:36 - 2014-08-11 09:32 - 00068456 _____ (Fuzhou Rockchip Electronics Co,Ltd.) C:\Windows\system32\Drivers\rockusb.sys
2015-03-17 17:29 - 2015-03-17 17:35 - 09571721 _____ () C:\Users\julian\Downloads\Release_DriverAssitant.rar
2015-03-16 22:32 - 2015-03-16 22:32 - 00000000 ____D () C:\Users\julian\Downloads\The Sims 3 v1.5.21 MOD
2015-03-15 15:41 - 2015-03-15 15:41 - 00591404 _____ () C:\Users\julian\Downloads\RockChip Batch Tool v1.7.zip
2015-03-15 15:41 - 2014-07-01 08:33 - 00000000 ____D () C:\Users\julian\Desktop\RockChip Batch Tool v1.7
2015-03-15 15:10 - 2014-06-08 11:59 - 00195258 _____ () C:\Users\julian\Desktop\RK3188Loader(L)_V2.10.bin
2015-03-15 15:08 - 2015-03-15 15:08 - 00177759 _____ () C:\Users\julian\Downloads\RK3188LoaderL_V2.10.7z
2015-03-15 15:00 - 2015-03-15 15:00 - 00000000 ____D () C:\Users\julian\Desktop\flash
2015-03-15 14:59 - 2013-08-29 19:59 - 00194738 _____ () C:\Users\julian\Desktop\RK3188Loader(L)_V1.24.bin
2015-03-15 14:57 - 2015-03-15 14:57 - 00546536 _____ () C:\Users\julian\Downloads\Oma_DevelopTool_Refresh.7z
2015-03-15 14:35 - 2015-03-15 14:35 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2015-03-15 14:28 - 2015-03-15 14:28 - 00000334 _____ () C:\DriverInstall2015-03-15.txt
2015-03-15 14:20 - 2015-03-20 18:20 - 00000000 ____D () C:\Users\julian\Desktop\cROM
2015-03-15 14:12 - 2015-03-15 14:20 - 352564223 _____ () C:\Users\julian\Downloads\Oma_RK31_tolino_tab8.9_JB_4.2.2_v1.0.7z
2015-03-13 22:40 - 2015-03-13 22:40 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2015-03-13 22:36 - 2015-03-13 22:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-03-13 22:36 - 2013-07-22 18:15 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2015-03-13 22:36 - 2013-07-22 18:15 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2015-03-13 22:35 - 2013-12-06 22:49 - 00000000 ____D () C:\Users\julian\Desktop\RK3188_ROOT_Everal
2015-03-13 22:30 - 2015-03-13 22:32 - 08671276 _____ () C:\Users\julian\Downloads\RK3188_ROOT_Everal.rar
2015-03-13 22:29 - 2015-03-26 19:28 - 00000000 ____D () C:\Users\julian\.android
2015-03-13 22:29 - 2015-03-13 22:41 - 00000000 ____D () C:\Program Files (x86)\Kingo ROOT
2015-03-13 22:29 - 2015-03-13 22:29 - 00001035 _____ () C:\Users\Public\Desktop\Kingo ROOT.lnk
2015-03-13 22:29 - 2015-03-13 22:29 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Kingosoft
2015-03-13 22:29 - 2015-03-13 22:29 - 00000000 ____D () C:\Users\julian\AppData\Local\Kingosoft
2015-03-13 22:29 - 2015-03-13 22:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT
2015-03-13 22:28 - 2015-03-13 22:28 - 18459176 _____ (Kingosoft Technology Ltd. ) C:\Users\julian\Downloads\android134_root.exe
2015-03-13 21:24 - 2015-03-13 21:24 - 01903054 _____ () C:\Users\julian\Downloads\HashTab_v5.2.0.14.zip
2015-03-13 21:24 - 2015-03-13 21:24 - 00000000 ____D () C:\Program Files\HashTab Shell Extension
2015-03-13 21:12 - 2015-03-13 21:24 - 766509056 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso
2015-03-13 21:05 - 2015-03-27 17:12 - 03427810 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-03-13 21:01 - 2009-11-25 12:47 - 01942856 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2015-03-13 21:01 - 2009-11-25 12:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe
2015-03-13 21:01 - 2009-11-25 12:47 - 00109912 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll
2015-03-13 21:01 - 2009-11-25 12:47 - 00048960 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2015-03-13 20:59 - 2015-03-13 20:59 - 01005568 _____ (Microsoft Corporation) C:\Users\julian\Downloads\dotNetFx45_Full_setup.exe
2015-03-10 18:55 - 2015-03-10 18:55 - 01835008 _____ () C:\Users\julian\Documents\TrueCrypt Rescue Disk.iso
2015-03-10 18:55 - 2015-03-10 18:55 - 00001254 _____ () C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2015-03-10 18:54 - 2015-03-10 18:54 - 01640984 _____ () C:\Users\julian\Downloads\SetupVirtualCloneDrive5470.exe
2015-03-10 18:54 - 2015-03-10 18:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
2015-03-10 18:54 - 2015-03-10 18:54 - 00000000 ____D () C:\Program Files (x86)\Elaborate Bytes
2015-03-10 18:53 - 2015-03-10 18:53 - 00000000 ____D () C:\ProgramData\TrueCrypt
2015-03-10 18:51 - 2015-03-10 18:56 - 00000000 ____D () C:\Users\julian\AppData\Roaming\TrueCrypt
2015-03-10 18:51 - 2015-03-10 18:51 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2015-03-10 18:51 - 2015-03-10 18:51 - 00000875 _____ () C:\Users\Public\Desktop\TrueCrypt.lnk
2015-03-10 18:51 - 2015-03-10 18:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt
2015-03-10 18:51 - 2015-03-10 18:51 - 00000000 ____D () C:\Program Files\TrueCrypt
2015-03-10 18:50 - 2015-03-10 18:50 - 03466248 _____ (TrueCrypt Foundation) C:\Users\julian\Downloads\truecrypt_setup_7.1a.exe
2015-03-10 18:20 - 2015-03-10 18:20 - 01581750 _____ () C:\Users\julian\Downloads\GPTool.rar
2015-03-10 18:20 - 2015-03-10 18:20 - 00000000 ____D () C:\Users\julian\Desktop\gptool
2015-03-10 18:14 - 2015-03-10 18:16 - 28764152 _____ () C:\Users\julian\Downloads\WPA wordlist.tar.gz.part
2015-03-10 18:03 - 2015-03-10 18:03 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso (5).torrent
2015-03-10 18:02 - 2015-03-10 18:02 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso (4).torrent
2015-03-10 18:02 - 2015-03-10 18:02 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso (3).torrent
2015-03-10 18:02 - 2015-03-10 18:02 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso (2).torrent
2015-03-10 18:01 - 2015-03-10 18:01 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso.torrent
2015-03-10 18:01 - 2015-03-10 18:01 - 00029578 _____ () C:\Users\julian\Downloads\ubuntu-12.04.4-desktop-i386.iso (1).torrent
2015-03-10 17:43 - 2015-03-10 17:43 - 00000000 ____D () C:\Users\julian\AppData\Local\Dögel_GmbH
2015-03-10 17:42 - 2015-03-10 17:42 - 00000000 ____D () C:\Capture
2015-03-10 17:41 - 2015-03-10 17:41 - 10444504 _____ () C:\Users\julian\Downloads\Evalaze_Free_2.2.0.0.zip
2015-03-10 17:23 - 2015-03-10 17:23 - 02058768 _____ () C:\Users\julian\Downloads\winrar-x64-521d.exe
2015-03-10 17:23 - 2015-03-10 17:23 - 00848808 _____ () C:\Users\julian\Downloads\BuBBle Protector FUD ByRoda.rar
2015-03-10 17:23 - 2015-03-10 17:23 - 00000000 ____D () C:\Users\julian\AppData\Roaming\WinRAR
2015-03-10 17:23 - 2015-03-10 17:23 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-03-10 17:23 - 2015-03-10 17:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-03-10 17:23 - 2015-03-10 17:23 - 00000000 ____D () C:\Program Files\WinRAR
2015-03-08 22:35 - 2015-03-08 22:35 - 00001807 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2015-03-08 22:35 - 2015-03-08 22:35 - 00001780 _____ () C:\Users\Public\Desktop\Apps.lnk
2015-03-08 22:34 - 2015-03-08 22:40 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2015-03-08 22:34 - 2015-03-08 22:34 - 00000000 ____D () C:\Users\julian\AppData\Local\Bluestacks
2015-03-08 22:34 - 2015-03-08 22:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks
2015-03-08 22:34 - 2015-03-08 22:34 - 00000000 ____D () C:\ProgramData\BlueStacks
2015-03-08 22:34 - 2015-03-08 22:34 - 00000000 ____D () C:\Program Files (x86)\BlueStacks
2015-03-08 22:33 - 2015-03-08 22:33 - 13555608 _____ (BlueStack Systems Inc.) C:\Users\julian\Downloads\BlueStacks-ThinInstaller.exe
2015-03-08 22:30 - 2015-03-08 22:30 - 00270282 _____ () C:\Users\julian\Downloads\info.staticfree.android.twentyfourhour_8.apk
2015-03-08 22:30 - 2015-03-08 22:30 - 00270282 _____ () C:\Users\julian\Desktop\info.staticfree.android.twentyfourhour_8.apk
2015-03-08 21:53 - 2015-03-08 21:53 - 00068628 _____ () C:\Users\julian\Desktop\Framework.apk
2015-03-08 21:33 - 2015-03-29 20:17 - 00000000 ____D () C:\Windows\pss
2015-03-08 20:42 - 2015-03-08 20:42 - 00000000 ____D () C:\Users\julian\Tracing
2015-03-08 19:27 - 2015-03-08 19:27 - 00000000 ____D () C:\ProgramData\Avg_Update_0215tb
2015-03-08 00:10 - 2015-03-10 18:12 - 00000000 ____D () C:\Users\julian\Downloads\GTA.San.Andreas.Karma-iND
2015-03-08 00:08 - 2015-03-08 00:09 - 00001092 _____ () C:\Users\julian\Downloads\d65932923198b89757fc167281f3c972 (1).dlc
2015-03-08 00:08 - 2015-03-08 00:08 - 00001092 _____ () C:\Users\julian\Downloads\d65932923198b89757fc167281f3c972.dlc
2015-03-07 23:13 - 2015-03-07 23:13 - 00000000 ____D () C:\Users\julian\Desktop\omegle
2015-03-07 23:12 - 2015-03-07 23:13 - 01246754 _____ () C:\Users\julian\Downloads\YOSFree Bin 1.4.3.5.zip
2015-03-07 22:32 - 2015-03-07 22:32 - 00000113 _____ () C:\Users\julian\Desktop\Neues Textdokument.txt
2015-03-07 15:08 - 2015-03-07 15:08 - 00748246 _____ ( ) C:\Users\julian\Downloads\reshack_setup.exe
2015-03-07 15:08 - 2015-03-07 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Resource Hacker
2015-03-07 15:08 - 2015-03-07 15:08 - 00000000 ____D () C:\Program Files (x86)\Resource Hacker
2015-03-07 14:28 - 2015-03-27 18:47 - 00000000 ____D () C:\Users\julian\VirtualBox VMs
2015-03-07 14:27 - 2015-03-31 18:26 - 00000000 ____D () C:\Users\julian\.VirtualBox
2015-03-07 14:27 - 2015-03-07 14:27 - 00836500 _____ () C:\Users\julian\Desktop\FINISHED.apk
2015-03-07 14:26 - 2015-03-07 14:26 - 00799497 _____ () C:\Users\julian\Downloads\com.orphan.amplayer_1.apk
2015-03-07 14:26 - 2015-03-07 14:26 - 00799497 _____ () C:\Users\julian\Desktop\com.orphan.amplayer_1.apk
2015-03-07 14:18 - 2015-03-07 14:24 - 348127232 _____ () C:\Users\julian\Downloads\android-x86-4.4-RC2.iso
2015-03-07 14:17 - 2015-03-07 14:17 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-03-07 14:17 - 2015-03-07 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-03-07 14:17 - 2015-03-02 16:20 - 00922168 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-03-07 14:17 - 2015-03-02 16:18 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-03-07 14:16 - 2015-03-07 14:16 - 00000000 ____D () C:\Program Files\Oracle
2015-03-07 14:12 - 2015-03-07 14:15 - 111197384 _____ (Oracle Corporation) C:\Users\julian\Downloads\VirtualBox-4.3.24-98716-Win.exe
2015-03-07 12:49 - 2015-03-07 12:49 - 00000000 ____D () C:\Users\julian\AppData\Local\AndroRat_Binder
2015-03-07 12:48 - 2015-03-07 12:48 - 00068664 _____ () C:\Users\julian\Desktop\System App Mover.apk
2015-03-07 12:48 - 2015-03-07 12:48 - 00000000 ____D () C:\Users\julian\apktool
2015-03-07 12:42 - 2015-03-07 12:42 - 00000000 ____D () C:\ProgramData\Sun
2015-03-07 12:42 - 2015-03-07 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-03-07 12:42 - 2015-03-07 12:41 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-07 12:41 - 2015-03-07 12:41 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-07 12:41 - 2015-03-07 12:41 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-07 12:40 - 2015-03-07 12:40 - 00561576 _____ (Oracle Corporation) C:\Users\julian\Downloads\chromeinstall-8u40.exe
2015-03-07 12:28 - 2015-03-07 12:28 - 00061285 _____ () C:\Users\julian\Downloads\de.j4velin.systemappmover_161.apk
2015-03-07 12:24 - 2015-03-07 12:24 - 00000000 ___RD () C:\Sandbox
2015-03-07 12:23 - 2015-03-07 12:23 - 10303034 _____ () C:\Users\julian\Downloads\Androrat by Laceratus.zip
2015-03-07 12:22 - 2015-03-29 18:57 - 00001670 _____ () C:\Windows\Sandboxie.ini
2015-03-07 12:22 - 2015-03-07 12:47 - 00001020 _____ () C:\Users\julian\Desktop\Sandboxed Web Browser.lnk
2015-03-07 12:22 - 2015-03-07 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-03-07 12:22 - 2015-03-07 12:22 - 00000000 ____D () C:\Program Files\Sandboxie
2015-03-07 12:21 - 2015-03-07 12:21 - 06980616 _____ (Sandboxie Holdings, LLC) C:\Users\julian\Downloads\SandboxieInstall.exe
2015-03-07 12:16 - 2015-03-07 12:16 - 00100790 _____ () C:\Users\julian\Downloads\WormFC.zip
2015-03-07 12:14 - 2015-03-07 12:14 - 00239648 _____ () C:\Users\julian\Downloads\DUCSetup_v4_1_0.exe
2015-03-07 12:14 - 2015-03-07 12:14 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC
2015-03-07 12:14 - 2015-03-07 12:14 - 00000000 ____D () C:\Users\julian\AppData\Local\Vitalwerks
2015-03-07 12:14 - 2015-03-07 12:14 - 00000000 ____D () C:\Program Files (x86)\No-IP
2015-03-07 12:10 - 2015-03-07 12:10 - 03069958 _____ () C:\Users\julian\Downloads\ICryptex Free Edition - Update 02.03.2015.zip
2015-03-03 19:45 - 2015-03-03 19:46 - 19192342 _____ () C:\Users\julian\Downloads\Windows_7_TOP50Gadgets.zip
2015-03-02 16:18 - 2015-03-02 16:18 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-03-02 16:18 - 2015-03-02 16:18 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-03-02 16:18 - 2015-03-02 16:18 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-03-02 16:18 - 2015-03-02 16:18 - 00116744 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSB.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-01 10:17 - 2010-06-07 00:35 - 00422574 _____ () C:\Windows\WindowsUpdate.log
2015-03-31 22:37 - 2015-02-27 21:35 - 00000000 ____D () C:\Users\julian\AppData\Roaming\uTorrent
2015-03-31 22:03 - 2009-07-14 06:45 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-31 22:03 - 2009-07-14 06:45 - 00009888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-31 21:58 - 2015-02-27 21:37 - 00000000 ____D () C:\Users\julian\AppData\Roaming\BitTorrent
2015-03-31 21:57 - 2015-02-27 22:46 - 00000000 ____D () C:\Users\julian\AppData\Roaming\Skype
2015-03-31 14:57 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-03-31 14:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-03-31 14:39 - 2010-06-07 00:40 - 00000000 ____D () C:\Users\julian
2015-03-31 14:33 - 2015-02-27 22:06 - 00000000 ____D () C:\Users\julian\AppData\Local\JDownloader v2.0
2015-03-31 13:36 - 2009-07-14 06:45 - 00355416 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-29 11:55 - 2009-10-24 18:10 - 00734338 _____ () C:\Windows\system32\perfh010.dat
2015-03-29 11:55 - 2009-10-24 18:10 - 00147142 _____ () C:\Windows\system32\perfc010.dat
2015-03-29 11:55 - 2009-10-24 18:01 - 00740008 _____ () C:\Windows\system32\perfh00C.dat
2015-03-29 11:55 - 2009-10-24 18:01 - 00149876 _____ () C:\Windows\system32\perfc00C.dat
2015-03-29 11:55 - 2009-10-24 17:51 - 00702426 _____ () C:\Windows\system32\perfh007.dat
2015-03-29 11:55 - 2009-10-24 17:51 - 00150052 _____ () C:\Windows\system32\perfc007.dat
2015-03-29 11:55 - 2009-07-14 07:13 - 03398150 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-28 20:31 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-03-28 20:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-28 20:22 - 2015-02-27 21:17 - 00137030 _____ () C:\Windows\PFRO.log
2015-03-28 20:05 - 2010-06-07 01:01 - 327081447 _____ () C:\Windows\MEMORY.DMP
2015-03-28 20:05 - 2010-06-07 01:01 - 00000000 ____D () C:\Windows\Minidump
2015-03-26 16:58 - 2015-02-27 21:09 - 00087400 _____ () C:\Users\julian\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-26 15:07 - 2015-02-27 22:16 - 00000000 ____D () C:\Program Files\PeerBlock
2015-03-26 14:06 - 2009-07-14 04:34 - 00000499 _____ () C:\Windows\win.ini
2015-03-26 14:05 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2015-03-26 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2015-03-25 12:53 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2015-03-24 13:54 - 2015-02-27 21:12 - 00000412 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2015-03-24 13:14 - 2015-02-27 21:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-24 12:01 - 2015-02-27 21:27 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-24 12:00 - 2015-02-27 21:12 - 00002840 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2015-03-24 11:58 - 2015-02-27 21:12 - 00013920 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2015-03-24 11:58 - 2015-02-27 21:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-24 11:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-22 19:31 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\MSBuild
2015-03-22 19:31 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-03-21 11:34 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\system32\WCN
2015-03-21 11:34 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts
2015-03-21 11:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\MUI
2015-03-21 11:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-21 11:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\com
2015-03-18 21:51 - 2015-02-27 21:29 - 00000000 ____D () C:\ProgramData\AVG2015
2015-03-17 20:29 - 2015-02-27 22:01 - 00000000 ____D () C:\Users\julian\AppData\Local\AVG Web TuneUp
2015-03-13 20:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-10 18:05 - 2015-02-27 22:21 - 545343947 _____ () C:\Users\julian\Downloads\g0tmi1k-wordlist.7z
2015-03-08 22:35 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-03-08 19:30 - 2015-02-27 22:00 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-03-07 15:09 - 2010-06-07 00:40 - 00000000 ____D () C:\Users\julian\AppData\Local\VirtualStore
2015-03-03 19:54 - 2010-01-09 11:34 - 00871318 _____ () C:\Users\julian\Desktop\NetworkMeterv2.4.gadget

==================== Files in the root of some directories =======

2015-03-24 13:36 - 2015-03-24 13:36 - 0000000 _____ () C:\Users\julian\AppData\Roaming\system.ini

Some content of TEMP:
====================
C:\Users\julian\AppData\Local\Temp\avgnt.exe
C:\Users\julian\AppData\Local\Temp\CM.Launcher.Win.exe
C:\Users\julian\AppData\Local\Temp\Newtonsoft.Json.dll
C:\Users\julian\AppData\Local\Temp\NLog.dll
C:\Users\julian\AppData\Local\Temp\proxy_vole228222603790026462.dll
C:\Users\julian\AppData\Local\Temp\System.Core.dll
C:\Users\julian\AppData\Local\Temp\System.Xml.Linq.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-21 11:21

==================== End Of Log ============================
         

--- --- ---


MFG

Nee, ausser Du hast Datenzugriff zwischen Host und VM aktiviert.


Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren .

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hi Schrauber

verstehe ich das jetzt richtig das mein Rechner wieder sauber ist ?

Kannst du mir das mit dem Datenzugriff unter der VirtualBox etwas genauer erläutern?

Habe in der VirtualBox noch alles in der Standard Einstellung.


MFG

Noch eine Frage:

Ich hatte den Rechner die ganze Zeit in den Ruhezustand gesetzt damit ich nicht herunterfahren muss weil ich dringend weg musste. Als ich den Rechner aus dem Ruhemodus holte startete er sofort neu ohne wie zuvor anzuzeigen hallo ich starte in 15 minuten neu!

Gruß

Das kann jetzt alles gewesen sein, auch ein Windows Update oder so. Logs sind sauber.

Windows in einer VM weiternutzen | c't

Hi Schrauber

Ich danke dir nochmal ganz ganz viel für deine Hilfe und wünsche dir einen schönen Tag.


Gruß

Gern Geschehen