Win 8.1 // DHL Statusreport Sendung Virus

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-06-2015
Ran by Bobomb (administrator) on BOBOMB-PC on 08-06-2015 20:01:36
Running from F:\Programme\frst
Loaded Profiles: Bobomb (Available Profiles: Bobomb & DefaultAppPool)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) F:\Programme\avast\install\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM GmbH) F:\Programme\fritz_powerline\PowerlineService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) F:\Programme\itunes\iTunesHelper.exe
(Adobe Systems Inc.) F:\Programme\cs5.5\Acrobat 10.0\Acrobat\acrotray.exe
(AVAST Software) F:\Programme\avast\install\avastui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Samsung Electronics.) F:\Treiber\samsung\Samsung Magician\Samsung Magician.exe
(Mozilla Corporation) F:\Programme\firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => F:\Programme\itunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => F:\Programme\cs5.5\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => F:\Programme\cs5.5\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2014-12-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => F:\Programme\avast\install\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-07-04] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-506915567-3553688366-1548111016-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-506915567-3553688366-1548111016-1000\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-21-506915567-3553688366-1548111016-1000\...\MountPoints2: {c80a44fc-7d6a-11e4-be93-6cf04956b3bb} - "E:\Startme.exe" 
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => F:\Programme\avast\install\ashShA64.dll [2014-07-22] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-506915567-3553688366-1548111016-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> F:\Programme\java\bin\ssv.dll [2014-09-02] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> F:\Programme\avast\install\aswWebRepIE64.dll [2014-07-22] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> F:\Programme\java\bin\jp2ssv.dll [2014-09-02] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> F:\Programme\java\bin\ssv.dll [2014-09-02] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> F:\Programme\avast\install\aswWebRepIE.dll [2014-07-22] (AVAST Software)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> F:\Programme\java\bin\jp2ssv.dll [2014-09-02] (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2014-12-03] (Adobe Systems Incorporated)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default
FF NewTab: about:blank
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-22] ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> F:\Programme\java\bin\dtplugin\npDeployJava1.dll [2014-09-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> F:\Programme\java\bin\plugin2\npjp2.dll [2014-09-02] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2012-09-20] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-22] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> F:\Programme\itunes\Mozilla Plugins\npitunes.dll [2012-08-08] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> F:\Programme\java\bin\dtplugin\npDeployJava1.dll [2014-09-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> F:\Programme\java\bin\plugin2\npjp2.dll [2014-09-02] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-20] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-20] (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> F:\Programme\cs5.5\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2012-09-20] (Adobe Systems)
FF Plugin HKU\S-1-5-21-506915567-3553688366-1548111016-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2014-10-01] ()
FF SearchPlugin: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\searchplugins\11-suche.xml [2014-07-26]
FF SearchPlugin: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\searchplugins\englische-ergebnisse.xml [2014-07-26]
FF SearchPlugin: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\searchplugins\gmx-suche.xml [2014-07-26]
FF SearchPlugin: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\searchplugins\lastminute.xml [2014-07-26]
FF SearchPlugin: C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\searchplugins\webde-suche.xml [2014-07-26]
FF Extension: Adblock Plus - C:\Users\Bobomb\AppData\Roaming\Mozilla\Firefox\Profiles\g41ig57k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - F:\Programme\cs5.5\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - F:\Programme\cs5.5\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-03-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - F:\Programme\avast\install\WebRep\FF
FF Extension: avast! Online Security - F:\Programme\avast\install\WebRep\FF [2014-05-23]
StartMenuInternet: FIREFOX.EXE - F:\Programme\firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-09]
CHR Extension: (Google Docs) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-09]
CHR Extension: (Google Drive) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-09]
CHR Extension: (YouTube) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-09]
CHR Extension: (Google Search) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-09]
CHR Extension: (Google Sheets) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-09]
CHR Extension: (AdBlock) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-02]
CHR Extension: (Avast Online Security) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-09]
CHR Extension: (Google Wallet) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-09]
CHR Extension: (Gmail) - C:\Users\Bobomb\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-09]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - F:\Programme\avast\install\WebRep\Chrome\aswWebRepChrome.crx [2014-07-22]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Bobomb\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-07-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; F:\Programme\avast\install\AvastSvc.exe [50344 2014-07-22] (AVAST Software)
R2 AVMPowerlineService; F:\Programme\fritz_powerline\PowerlineService.exe [139264 2014-05-21] (AVM GmbH) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [25600 2014-02-24] (Microsoft Corporation)
S2 SkypeUpdate; F:\Programme\skype\Updater\Updater.exe [315488 2015-02-18] (Skype Technologies)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-02-24] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [546304 2014-02-24] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-22] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-22] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-22] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-22] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-22] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-22] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-22] ()
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-07-21] (LogMeIn Inc.)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [173568 2014-02-24] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 Saffire; C:\Windows\System32\Drivers\Saffire.sys [226768 2013-09-18] (Focusrite A.E.)
S3 SaffireAudio; C:\Windows\system32\drivers\SaffireAudio.sys [47824 2013-09-18] (Focusrite A.E.)
S3 SaffireMidi; C:\Windows\system32\drivers\SaffireMidi.sys [38352 2013-09-18] (Focusrite A.E.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
R3 WUDFWpdComp; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)
U3 idsvc; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-08 20:01 - 2015-06-08 20:01 - 00000000 ____D C:\FRST
2015-06-08 20:00 - 2015-06-08 20:00 - 00000000 _____ C:\Users\Bobomb\defogger_reenable
2015-06-07 23:30 - 2015-06-07 23:30 - 00278960 _____ C:\WINDOWS\Minidump\060715-10625-01.dmp
2015-06-05 18:19 - 2015-05-22 15:08 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 01119232 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 01020928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 00756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 00422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2015-06-05 18:19 - 2015-05-21 15:08 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-06-05 18:19 - 2015-04-17 00:07 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-06-03 19:08 - 2015-06-07 23:30 - 749613294 _____ C:\WINDOWS\MEMORY.DMP
2015-06-03 19:08 - 2015-06-03 19:08 - 00324848 _____ C:\WINDOWS\Minidump\060315-14843-01.dmp
2015-06-02 20:35 - 2015-06-02 20:35 - 00000000 ____D C:\Users\Bobomb\AppData\Local\GWX
2015-05-30 17:57 - 2015-06-01 00:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-05-14 16:31 - 2015-06-07 23:31 - 00007161 _____ C:\WINDOWS\setupact.log
2015-05-14 16:31 - 2015-05-14 16:31 - 00000306 _____ C:\WINDOWS\PFRO.log
2015-05-14 16:31 - 2015-05-14 16:31 - 00000000 _____ C:\WINDOWS\setuperr.log
2015-05-13 20:30 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 20:30 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 20:22 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-05-13 20:22 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-05-13 20:22 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-05-13 20:22 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-05-13 20:22 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-05-13 20:22 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-05-13 20:22 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-05-13 20:22 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-05-13 20:22 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-05-13 20:22 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-05-13 20:22 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-05-13 20:22 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2015-05-13 20:22 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-05-13 20:22 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-05-13 20:22 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-05-13 20:22 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-05-13 20:22 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-05-13 20:22 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-05-13 20:22 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-05-13 20:22 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-05-13 20:22 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-05-13 20:22 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-05-13 20:22 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-05-13 20:22 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-05-13 20:22 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-05-13 20:22 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-05-13 20:22 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-05-13 20:22 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-05-13 20:22 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-05-13 20:22 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-05-13 20:22 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-05-13 20:22 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-05-13 20:22 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-05-13 20:22 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-05-13 20:22 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-05-13 20:22 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-05-13 20:22 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-05-13 20:22 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-05-13 20:22 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-05-13 20:22 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-05-13 20:22 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-05-13 20:22 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-05-13 20:22 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-05-13 20:22 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-05-13 20:22 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-05-13 20:22 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-05-13 20:22 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-05-13 20:22 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-05-13 20:22 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-05-13 20:22 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2015-05-13 20:22 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2015-05-13 20:22 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2015-05-13 20:22 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2015-05-13 20:22 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2015-05-13 20:22 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2015-05-13 20:22 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-05-13 20:22 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-05-13 20:22 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2015-05-13 20:22 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2015-05-13 20:22 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2015-05-13 20:22 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-05-13 20:22 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-05-13 20:22 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdbinst.exe
2015-05-13 20:22 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sdbinst.exe
2015-05-13 20:22 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-05-13 20:22 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2015-05-13 20:22 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-05-13 20:22 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2015-05-13 20:22 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-13 20:22 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-05-13 20:22 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-05-13 20:22 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-05-13 20:21 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-05-13 20:21 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-05-13 20:21 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-05-13 20:21 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-05-13 20:21 - 2015-03-13 02:29 - 00410017 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-05-13 20:20 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdshext.dll
2015-05-13 20:20 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpdshext.dll
2015-05-13 20:15 - 2015-06-08 19:54 - 01959791 _____ C:\WINDOWS\WindowsUpdate.log

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-08 20:00 - 2014-02-24 21:04 - 00000000 ____D C:\Users\Bobomb
2015-06-08 20:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-08 19:45 - 2014-09-09 20:04 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-08 19:45 - 2014-09-09 20:04 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-08 19:21 - 2015-04-22 20:17 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-06-08 18:07 - 2013-11-14 09:26 - 02063924 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-06-08 18:07 - 2013-11-14 09:11 - 00876992 _____ C:\WINDOWS\system32\perfh007.dat
2015-06-08 18:07 - 2013-11-14 09:11 - 00201082 _____ C:\WINDOWS\system32\perfc007.dat
2015-06-08 18:07 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-06-07 23:37 - 2014-02-24 20:01 - 00000000 ____D C:\Users\Bobomb\AppData\Roaming\Skype
2015-06-07 23:31 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-06-07 23:30 - 2015-04-16 20:41 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-07 23:30 - 2014-12-03 20:55 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-07 23:30 - 2014-08-10 14:38 - 00000000 ____D C:\WINDOWS\Minidump
2015-06-07 23:30 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-06-07 21:00 - 2014-06-28 20:27 - 00000000 ____D C:\Users\Bobomb\AppData\Local\Adobe
2015-06-06 08:17 - 2014-02-24 16:26 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-506915567-3553688366-1548111016-1000
2015-06-05 18:32 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-06-03 20:13 - 2014-03-03 17:43 - 00000000 ____D C:\Users\Bobomb\Documents\Native Instruments
2015-06-03 19:08 - 2014-02-24 19:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-03 19:08 - 2013-08-22 16:44 - 05346312 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-05-30 23:07 - 2014-05-23 22:13 - 00004160 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-05-26 17:46 - 2014-09-09 20:05 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-22 21:20 - 2015-04-13 21:50 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-05-22 21:20 - 2015-04-13 21:50 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-05-20 19:40 - 2014-09-09 20:04 - 00004110 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-20 19:40 - 2014-09-09 20:04 - 00003874 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-14 17:32 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-05-14 16:31 - 2014-06-28 20:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-14 16:31 - 2014-06-28 20:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 20:43 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-05-13 20:43 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2015-05-13 20:30 - 2014-02-24 16:41 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-05-13 20:27 - 2014-06-28 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 20:27 - 2014-02-24 16:41 - 140425016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-05-13 20:26 - 2013-11-14 09:13 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-12 22:26 - 2014-03-10 14:40 - 00000695 _____ C:\Users\Public\Desktop\CCleaner.lnk

==================== Files in the root of some directories =======

2014-06-25 18:34 - 2015-04-29 22:01 - 0001456 _____ () C:\Users\Bobomb\AppData\Local\Adobe Für Web speichern 12.0 Prefs
2014-02-24 15:57 - 2014-11-24 02:48 - 0007597 _____ () C:\Users\Bobomb\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-08 18:29

==================== End of log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-06-2015
Ran by Bobomb at 2015-06-08 20:02:05
Running from F:\Programme\frst
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-506915567-3553688366-1548111016-500 - Administrator - Disabled)
Bobomb (S-1-5-21-506915567-3553688366-1548111016-1000 - Administrator - Enabled) => C:\Users\Bobomb
Gast (S-1-5-21-506915567-3553688366-1548111016-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.13 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Creative Suite 5.5 Design Standard (HKLM-x32\...\{53CF3920-648B-4F99-8D05-6A6C5298F57B}) (Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft)
Apple Application Support (HKLM-x32\...\{63EC2120-1742-4625-AA47-C6A8AEC9C64C}) (Version: 2.2.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
BattleBlock Theater (HKLM-x32\...\Steam App 238460) (Version:  - The Behemoth)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version: 6.7.1.8141 - Steinberg Media Technologies GmbH)
FRITZ!Powerline (HKLM-x32\...\{F9C9378B-78D5-4CC0-8683-B7915DFEA9C5}) (Version: 01.00.65 - AVM Berlin)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
iTunes (HKLM\...\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}) (Version: 10.7.0.21 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)
LibreOffice 4.2.3.3 (HKLM-x32\...\{4117DF3C-6677-4A22-90B7-FF06923417E9}) (Version: 4.2.3.3 - The Document Foundation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Firefox 38.0.5 (x86 de) (HKU\S-1-5-21-506915567-3553688366-1548111016-1000\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.6.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKU\S-1-5-21-506915567-3553688366-1548111016-1000\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
Native Instruments Abbey Road 60s Drums (HKLM-x32\...\Native Instruments Abbey Road 60s Drums) (Version:  - Native Instruments)
Native Instruments Absynth 5 (HKLM-x32\...\Native Instruments Absynth 5) (Version: 5.2.0.1277 - Native Instruments)
Native Instruments Battery 3 (HKLM-x32\...\Native Instruments Battery 3) (Version:  - Native Instruments)
Native Instruments Battery Library Importer for Maschine (HKLM-x32\...\Native Instruments Battery Library Importer for Maschine) (Version:  - Native Instruments)
Native Instruments Berlin Concert Grand (HKLM-x32\...\Native Instruments Berlin Concert Grand) (Version:  - Native Instruments)
Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 1.6.3.46 - Native Instruments)
Native Instruments FM8 (HKLM-x32\...\Native Instruments FM8) (Version: 1.3.0.1244 - Native Instruments)
Native Instruments Guitar Rig 5 (HKLM-x32\...\Native Instruments Guitar Rig 5) (Version: 5.2.0.2770 - Native Instruments)
Native Instruments Guitar Rig Mobile IO Driver (HKLM-x32\...\Native Instruments Guitar Rig Mobile IO Driver) (Version:  - Native Instruments)
Native Instruments Guitar Rig Session IO Driver (HKLM-x32\...\Native Instruments Guitar Rig Session IO Driver) (Version:  - Native Instruments)
Native Instruments Komplete 8 (HKLM-x32\...\Native Instruments Komplete 8) (Version:  - Native Instruments)
Native Instruments Kontakt 5 (HKLM-x32\...\Native Instruments Kontakt 5) (Version: 5.3.1.37 - Native Instruments)
Native Instruments Kontakt Factory Library (HKLM-x32\...\Native Instruments Kontakt Factory Library) (Version: 1.1.0.6 - Native Instruments)
Native Instruments Massive (HKLM-x32\...\Native Instruments Massive) (Version: 1.4.0.292 - Native Instruments)
Native Instruments New York Concert Grand (HKLM-x32\...\Native Instruments New York Concert Grand) (Version:  - Native Instruments)
Native Instruments Rammfire (HKLM-x32\...\Native Instruments Rammfire) (Version: 2.0.0.4 - Native Instruments)
Native Instruments Reaktor 5 (HKLM-x32\...\Native Instruments Reaktor 5) (Version: 5.9.0.725 - Native Instruments)
Native Instruments Reaktor Prism (HKLM-x32\...\Native Instruments Reaktor Prism) (Version: 1.4.0.3 - Native Instruments)
Native Instruments Reaktor Spark R2 (HKLM-x32\...\Native Instruments Reaktor Spark R2) (Version: 1.3.0.2 - Native Instruments)
Native Instruments Reflektor (HKLM-x32\...\Native Instruments Reflektor) (Version: 2.0.0.1 - Native Instruments)
Native Instruments Replika (HKLM-x32\...\Native Instruments Replika) (Version: 1.2.0.699 - Native Instruments)
Native Instruments Rig Kontrol 3 Driver (HKLM-x32\...\Native Instruments Rig Kontrol 3 Driver) (Version:  - Native Instruments)
Native Instruments Scarbee MM-Bass (HKLM-x32\...\Native Instruments Scarbee MM-Bass) (Version:  - Native Instruments)
Native Instruments Scarbee Vintage Keys (HKLM-x32\...\Native Instruments Scarbee Vintage Keys) (Version:  - Native Instruments)
Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: 2.6.0.137 - Native Instruments)
Native Instruments Studio Drummer (HKLM-x32\...\Native Instruments Studio Drummer) (Version:  - Native Instruments)
Native Instruments The Finger R2 (HKLM-x32\...\Native Instruments The Finger R2) (Version: 1.3.0.2 - Native Instruments)
Native Instruments Traktors 12 (HKLM-x32\...\Native Instruments Traktors 12) (Version: 2.0.0.2 - Native Instruments)
Native Instruments Transient Master (HKLM-x32\...\Native Instruments Transient Master) (Version:  - Native Instruments)
Native Instruments Upright Piano (HKLM-x32\...\Native Instruments Upright Piano) (Version:  - Native Instruments)
Native Instruments Vienna Concert Grand (HKLM-x32\...\Native Instruments Vienna Concert Grand) (Version:  - Native Instruments)
Native Instruments Vintage Organs (HKLM-x32\...\Native Instruments Vintage Organs) (Version:  - Native Instruments)
Native Instruments West Africa (HKLM-x32\...\Native Instruments West Africa) (Version:  - Native Instruments)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PhonerLite 2.21 (HKLM-x32\...\PhonerLite_is1) (Version: 2.21 - Heiko Sommerfeldt)
Rocksmith 2014 (HKLM-x32\...\Steam App 221680) (Version:  - Ubisoft - San Francisco)
Saffire MixControl 3.3 (HKLM\...\Saffire PRO 40_is1) (Version: 3.3 - Focusrite Audio Engineering Ltd.)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Steinberg Cubase LE AI Elements 7 64bit (HKLM\...\{67E7C608-D0EA-4273-B374-50ABE42FBE08}) (Version: 7.0.7 - Steinberg Media Technologies GmbH)
Steinberg Drum Loop Expansion 01 (HKLM-x32\...\{490BF87E-1F75-4453-BF55-9F540543A3CA}) (Version: 2.0.0.0 - Steinberg Media Technologies GmbH)
Steinberg Groove Agent ONE Content (HKLM-x32\...\{BD86F1AC-B594-46E4-85DC-1258AC9E2232}) (Version: 1.0.0.003 - Steinberg Media Technologies GmbH)
Steinberg Groove Agent ONE Vintage Beatboxes (HKLM-x32\...\{DBF4BC99-53F1-4C97-84C3-7557D103E182}) (Version: 1.0.0.000 - Steinberg Media Technologies GmbH)
Steinberg HALion Sonic SE 64bit (HKLM\...\{B99C316B-C135-43B5-8E77-2BC5E241F964}) (Version: 1.6.3 - Steinberg Media Technologies GmbH)
Steinberg HALion Sonic SE Content for Cubase LE AI Elements (HKLM-x32\...\{CF45002F-2205-4116-BB51-2D015F436CAC}) (Version: 1.6.3 - Steinberg Media Technologies GmbH)
Steinberg HALionOne (HKLM-x32\...\{E70E7159-93B1-470D-9FBD-D8E9EF34B538}) (Version: 1.1.0.457 - Steinberg Media Technologies GmbH)
Steinberg HALionOne Essential Set (HKLM-x32\...\{C04D5974-F528-4347-A494-EAF56124CC1A}) (Version: 1.0.1.457 - Steinberg Media Technologies GmbH)
Steinberg Midi Loop Library (HKLM-x32\...\{89DE2651-6DD9-4C15-AC94-8348362D456C}) (Version: 1.0.0 - Steinberg Media Technologies GmbH)
Steinberg REVerence Content 01 (HKLM-x32\...\{532B917B-8235-4FA5-BE36-643A8BB053A5}) (Version: 2.0.1.000 - Steinberg Media Technologies GmbH)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Steinberg VST Amp Rack Content 01 (HKLM-x32\...\{8CBA7E47-48DA-47DC-8E98-6984BA830295}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Warcraft III (HKLM-x32\...\Warcraft III) (Version:  - Blizzard Entertainment)
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

22-05-2015 21:19:57 Windows Update
30-05-2015 15:48:41 Geplanter Prüfpunkt
05-06-2015 18:31:46 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E15E0FD-DD1B-4D9C-AAD9-7997DFF36595} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {11EDC131-4CD3-449A-B03F-86BF5E008A23} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {171B37EF-4051-4866-B042-46F5E0B0D1B0} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {18D6AFD7-457D-4520-9E24-039F5149300E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-22] (Adobe Systems Incorporated)
Task: {19F31AA2-C3BE-44EE-93E3-74A7DE92323C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {1D44399C-778B-4EE2-9443-133DEAE21048} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {1FB71E07-8E27-4E7B-A425-DDF3C1005AF6} - System32\Tasks\CCleanerSkipUAC => F:\Programme\ccleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {2116D7B7-D2B0-49EA-AFE4-712B423CBC36} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {2CF41CF4-FD29-455E-89DF-0A6660FB2FAA} - System32\Tasks\AdobeAAMUpdater-1.0-Bobomb-PC-Bobomb => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {3A1346BD-92F5-46F3-8B12-3663E6894927} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {3A949DEE-E135-4CB9-9080-8504E87F0CB6} - System32\Tasks\SamsungMagician => F:\Treiber\samsung\Samsung Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.)
Task: {49774A96-40D7-424C-90C0-77DF98131FDA} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {4E8C8884-8F45-4D07-8BB4-E455440B2016} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {52A85C4E-399E-4B5D-B120-A10A9AA81B13} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {558F7199-2177-4C4C-BC34-F4FCE05D88B9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {6448A7D0-93B1-40D3-BF7D-B927E355A43E} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {66656383-9927-4954-BEEF-C6610252FDAC} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {690F5169-F562-497C-90D2-FE7E03A2280C} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {83F79601-3B00-401D-9AAB-DA5BCAF4A379} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {94BA226D-AE7F-4502-8861-68D0D15B4913} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {9B451E2E-1D16-4FE8-A6CB-28B46A4DE645} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {9E74216B-3AB3-4D9F-8655-C660C09B6BD6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {9E8CCF42-A357-48A6-A425-214C8A44584E} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {A0A00409-4227-4518-A0E6-80367EB92860} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {A638C1B8-C586-4E79-A164-6FF3CF215234} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {A7087DA3-D6BC-431C-ACC5-EA3D8E8B7265} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.)
Task: {A904C230-21F5-4611-8691-6305AE322C82} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {AC12AD9D-B113-4782-BFEF-E54C750292F0} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {B1279F86-50E4-48D3-8DFD-32350ABB0397} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {CE797633-B86B-469C-814B-563C153BE704} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {DA6AFA66-9AE1-477F-8470-B1E07744F821} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {E0E0EE0C-58A1-4B27-8B72-3EC0901D4BC0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.)
Task: {E5ADFF03-553F-42C8-8656-26404BB9D124} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {EA59394D-9A90-496C-9EE8-88B28A17C3F1} - System32\Tasks\avast! Emergency Update => F:\Programme\avast\install\AvastEmUpdate.exe [2014-07-22] (AVAST Software)
Task: {F32F3376-6000-4E0E-B405-530F573FB9AF} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {F470B9EC-6F0D-4ACC-A503-9074F8F7A7AF} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {FEC44BFE-6C00-4801-8E6E-AF3DD290C51C} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-03-21 21:36 - 2007-03-16 03:50 - 00022016 _____ () C:\WINDOWS\System32\ps3450v6.dll
2014-03-21 21:36 - 2007-02-07 14:41 - 00103424 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\XP3450u.dll
2014-07-22 20:10 - 2014-07-22 20:10 - 00301152 _____ () F:\Programme\avast\install\aswProperty.dll
2015-06-07 21:01 - 2015-06-07 21:01 - 02952192 _____ () F:\Programme\avast\install\defs\15060701\algo.dll
2012-08-27 22:33 - 2012-08-27 22:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 22:33 - 2012-08-27 22:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-03 20:07 - 2014-12-03 20:07 - 00019968 _____ () F:\Programme\cs5.5\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2014-07-22 20:10 - 2014-07-22 20:10 - 19329904 _____ () F:\Programme\avast\install\libcef.dll
2014-08-10 14:47 - 2014-09-28 18:59 - 00019872 _____ () F:\Treiber\samsung\Samsung Magician\SAMSUNG_SSD.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Bobomb\SkyDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-506915567-3553688366-1548111016-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Bobomb\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\dark_wood-1920x1080.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [{076144E1-24C6-44A1-BF8C-ADEDDC87AD40}] => (Allow) F:\Programme\skype\Phone\Skype.exe
FirewallRules: [{A22DF709-D07A-4A7C-B51F-EBFEB4F4FCF4}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{3D57099B-C5C1-44BA-8F32-43195BCB6816}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{20FC576D-8A26-4E75-A9BA-D797E7332ADD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{668DC7EF-0C6E-4F9D-81F0-5D49AB09CC67}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E99FF27A-BA3C-4085-8D09-DDD29B182528}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{5F4D74A7-33F7-4384-BDE8-00CA4412D9C3}] => (Allow) F:\Programme\itunes\iTunes.exe
FirewallRules: [TCP Query User{19676A82-709F-4BDB-94DB-5DCF54816F77}F:\programme\java\bin\javaw.exe] => (Allow) F:\programme\java\bin\javaw.exe
FirewallRules: [UDP Query User{CE44C607-A66E-45B2-98F4-2845DAC2D42C}F:\programme\java\bin\javaw.exe] => (Allow) F:\programme\java\bin\javaw.exe
FirewallRules: [{00D1CDB1-4414-44CC-83D0-DC27AAC0E03B}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{5906A049-37E6-4B8C-9427-AC361F509DCA}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{0E541513-4B8A-4856-8E8A-7793AD162607}] => (Allow) G:\anno2070\Anno5.exe
FirewallRules: [{8334EE13-ED1D-4B5D-BDA0-E918A0002243}] => (Allow) G:\anno2070\Anno5.exe
FirewallRules: [{B29AF530-F8BF-4F16-B546-3218CEADC0A6}] => (Allow) G:\anno2070\AutoPatcher.exe
FirewallRules: [{BD1BE4F3-07E9-40F1-B1F3-6AC2A66D5B0A}] => (Allow) G:\anno2070\AutoPatcher.exe
FirewallRules: [{0BD09373-4465-4229-B202-CE3880B87F0A}] => (Allow) G:\anno2070\InitEngine.exe
FirewallRules: [{D704334A-7CB3-4AB3-ADC2-918E27EC6761}] => (Allow) G:\anno2070\InitEngine.exe
FirewallRules: [TCP Query User{AA275FCF-0533-4973-8A99-3BBA8365D0D1}G:\warcraft_iii\warcraft iii\war3.exe] => (Allow) G:\warcraft_iii\warcraft iii\war3.exe
FirewallRules: [UDP Query User{BED82749-89A8-4C6D-B450-C4E00B1D849E}G:\warcraft_iii\warcraft iii\war3.exe] => (Allow) G:\warcraft_iii\warcraft iii\war3.exe
FirewallRules: [TCP Query User{C5E6A2B2-6913-4040-B68E-09916FCC3871}G:\trackmania\tmnationsforever\tmforever.exe] => (Allow) G:\trackmania\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{006A0526-9120-48A1-9428-0AF12BEDD101}G:\trackmania\tmnationsforever\tmforever.exe] => (Allow) G:\trackmania\tmnationsforever\tmforever.exe
FirewallRules: [{7714F13B-FB85-4C11-9F24-995DD612BB83}] => (Allow) G:\steam\Steam.exe
FirewallRules: [{A271AC43-A926-4408-BE60-0129E0FA3EA4}] => (Allow) G:\steam\Steam.exe
FirewallRules: [{5DC4C41B-8F5F-4D36-8EF5-F0B3C2E70442}] => (Allow) G:\steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{D6744541-937F-4968-9253-61BDBA3087BA}] => (Allow) G:\steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{E423FE16-8839-44D7-8894-F8E18458496E}] => (Allow) G:\steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{C13BD5CA-603F-4D76-A9B8-BABA22EA5A42}] => (Allow) G:\steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{C380F166-BA99-4A8C-B2AC-0744ED568E73}] => (Allow) G:\steam\bin\steamwebhelper.exe
FirewallRules: [{2A6E3CDB-0729-43EC-B98D-58842B01CF01}] => (Allow) G:\steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{8417C6CE-2BBA-4157-9FED-9F3083A6658D}F:\studio\cubase7\cubase le ai elements 7.exe] => (Allow) F:\studio\cubase7\cubase le ai elements 7.exe
FirewallRules: [UDP Query User{016F13A0-853E-4C41-B529-C4C2D5850304}F:\studio\cubase7\cubase le ai elements 7.exe] => (Allow) F:\studio\cubase7\cubase le ai elements 7.exe
FirewallRules: [TCP Query User{E008AB37-1240-4849-95C5-4DBE572091CF}F:\studio\cubase7\components\vstbridgeapp.exe] => (Allow) F:\studio\cubase7\components\vstbridgeapp.exe
FirewallRules: [UDP Query User{AE845237-DAA3-4E0B-8CF3-585BB9CEE9C8}F:\studio\cubase7\components\vstbridgeapp.exe] => (Allow) F:\studio\cubase7\components\vstbridgeapp.exe
FirewallRules: [{0F124021-C149-4B41-B501-96F12FA6535F}] => (Block) F:\studio\cubase7\components\vstbridgeapp.exe
FirewallRules: [{E57A5C34-D816-4154-BDEA-CE5D316F4AF1}] => (Block) F:\studio\cubase7\components\vstbridgeapp.exe
FirewallRules: [{1133579B-0BDF-4451-BEC0-DFC622716485}] => (Block) F:\studio\cubase7\cubase le ai elements 7.exe
FirewallRules: [{A6D6CD04-93C9-4E45-B5F1-EFD4FCC21187}] => (Block) F:\studio\cubase7\cubase le ai elements 7.exe
FirewallRules: [{E14E6C76-855F-45D0-8BF6-5B17003C3889}] => (Allow) G:\steam\SteamApps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [{81223603-BB1B-4FB6-B655-E7278CA870EC}] => (Allow) G:\steam\SteamApps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [{2C2C8F79-6BAD-437D-9E63-580328098A39}] => (Allow) G:\steam\SteamApps\common\Rocksmith2014\Rocksmith2014.exe
FirewallRules: [{2829DEFB-7C21-47A7-AEA8-E044B7639929}] => (Allow) G:\steam\SteamApps\common\Rocksmith2014\Rocksmith2014.exe
FirewallRules: [TCP Query User{D32E96FB-DB35-4E3F-8298-E8A51E16D4C3}F:\programme\phoner_light\phonerlite\phonerlite.exe] => (Allow) F:\programme\phoner_light\phonerlite\phonerlite.exe
FirewallRules: [UDP Query User{7B8DC6E6-7C79-4627-830C-5F124595C5E5}F:\programme\phoner_light\phonerlite\phonerlite.exe] => (Allow) F:\programme\phoner_light\phonerlite\phonerlite.exe
FirewallRules: [TCP Query User{3992DA38-60CC-4106-A9B3-7CAE9A72B61E}F:\programme\firefox\firefox.exe] => (Allow) F:\programme\firefox\firefox.exe
FirewallRules: [UDP Query User{926270FA-B240-4739-A359-88C86B933BD5}F:\programme\firefox\firefox.exe] => (Allow) F:\programme\firefox\firefox.exe
FirewallRules: [{FE89299C-5E5D-4FDF-951C-39F21D0E6B31}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Marvell 91xx Config ATA Device
Description: Marvell 91xx Config ATA Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/07/2015 11:17:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000359dd
ID des fehlerhaften Prozesses: 0xa00
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5

Error: (06/05/2015 06:31:49 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (06/05/2015 06:31:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (06/03/2015 08:43:31 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (06/03/2015 07:58:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: soffice.bin, Version: 4.2.3.3, Zeitstempel: 0x5344be3a
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001df63
ID des fehlerhaften Prozesses: 0x9e0
Startzeit der fehlerhaften Anwendung: 0xsoffice.bin0
Pfad der fehlerhaften Anwendung: soffice.bin1
Pfad des fehlerhaften Moduls: soffice.bin2
Berichtskennung: soffice.bin3
Vollständiger Name des fehlerhaften Pakets: soffice.bin4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: soffice.bin5

Error: (06/03/2015 07:55:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: soffice.bin, Version: 4.2.3.3, Zeitstempel: 0x5344be3a
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001df63
ID des fehlerhaften Prozesses: 0x77c
Startzeit der fehlerhaften Anwendung: 0xsoffice.bin0
Pfad der fehlerhaften Anwendung: soffice.bin1
Pfad des fehlerhaften Moduls: soffice.bin2
Berichtskennung: soffice.bin3
Vollständiger Name des fehlerhaften Pakets: soffice.bin4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: soffice.bin5

Error: (06/03/2015 07:36:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: InDesign.exe, Version: 7.5.3.333, Zeitstempel: 0x4f6b9e72
Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.8387, Zeitstempel: 0x51ea24a5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003b36a
ID des fehlerhaften Prozesses: 0x7a8
Startzeit der fehlerhaften Anwendung: 0xInDesign.exe0
Pfad der fehlerhaften Anwendung: InDesign.exe1
Pfad des fehlerhaften Moduls: InDesign.exe2
Berichtskennung: InDesign.exe3
Vollständiger Name des fehlerhaften Pakets: InDesign.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: InDesign.exe5

Error: (05/31/2015 00:42:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dota.exe, Version: 0.0.0.0, Zeitstempel: 0x55601047
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x05d0bf80
ID des fehlerhaften Prozesses: 0x5f4
Startzeit der fehlerhaften Anwendung: 0xdota.exe0
Pfad der fehlerhaften Anwendung: dota.exe1
Pfad des fehlerhaften Moduls: dota.exe2
Berichtskennung: dota.exe3
Vollständiger Name des fehlerhaften Pakets: dota.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: dota.exe5

Error: (05/30/2015 11:04:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Steam.exe, Version 2.76.57.19 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: b34

Startzeit: 01d09b1576846dd1

Endzeit: 4294967295

Anwendungspfad: G:\steam\Steam.exe

Berichts-ID: 6649017b-070f-11e5-be9d-6cf04956b3bb

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (05/30/2015 11:03:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dota.exe, Version: 0.0.0.0, Zeitstempel: 0x55601047
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x06afbf80
ID des fehlerhaften Prozesses: 0x110c
Startzeit der fehlerhaften Anwendung: 0xdota.exe0
Pfad der fehlerhaften Anwendung: dota.exe1
Pfad des fehlerhaften Moduls: dota.exe2
Berichtskennung: dota.exe3
Vollständiger Name des fehlerhaften Pakets: dota.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: dota.exe5


System errors:
=============
Error: (06/08/2015 06:30:57 PM) (Source: DCOM) (EventID: 10010) (User: Bobomb-PC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (06/08/2015 06:30:27 PM) (Source: DCOM) (EventID: 10010) (User: Bobomb-PC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (06/07/2015 11:30:16 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000003b (0x00000000c0000005, 0xfffff8010208f704, 0xffffd000efec4950, 0x0000000000000000)C:\WINDOWS\MEMORY.DMP060715-10625-01

Error: (06/07/2015 11:30:15 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎07.‎06.‎2015 um 23:28:19 unerwartet heruntergefahren.

Error: (06/07/2015 11:18:05 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (06/07/2015 09:14:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (06/07/2015 09:14:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (06/07/2015 09:09:39 PM) (Source: DCOM) (EventID: 10010) (User: Bobomb-PC)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (06/07/2015 09:09:09 PM) (Source: DCOM) (EventID: 10010) (User: Bobomb-PC)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (06/06/2015 06:12:14 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar


Microsoft Office:
=========================
Error: (06/07/2015 11:17:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2ntdll.dll6.3.9600.17736550f4336c000000500000000000359dda0001d0a153ce3254ecC:\WINDOWS\Explorer.EXEC:\WINDOWS\SYSTEM32\ntdll.dll92569d55-0d5a-11e5-be9f-6cf04956b3bb

Error: (06/05/2015 06:31:49 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)

Error: (06/05/2015 06:31:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (06/03/2015 08:43:31 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)

Error: (06/03/2015 07:58:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: soffice.bin4.2.3.35344be3antdll.dll6.3.9600.17736550f42c2c00000050001df639e001d09e2686a5325bF:\Programme\libre_office\program\soffice.binC:\WINDOWS\SYSTEM32\ntdll.dll34c26169-0a1a-11e5-be9f-6cf04956b3bb

Error: (06/03/2015 07:55:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: soffice.bin4.2.3.35344be3antdll.dll6.3.9600.17736550f42c2c00000050001df6377c01d09e226bddf3d4F:\Programme\libre_office\program\soffice.binC:\WINDOWS\SYSTEM32\ntdll.dllc3e1b0a6-0a19-11e5-be9f-6cf04956b3bb

Error: (06/03/2015 07:36:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: InDesign.exe7.5.3.3334f6b9e72MSVCR90.dll9.0.30729.838751ea24a5c00000050003b36a7a801d09e231c6412cdF:\Programme\cs5.5\Adobe InDesign CS5.5\InDesign.exeC:\WINDOWS\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\MSVCR90.dll0d577b09-0a17-11e5-be9f-6cf04956b3bb

Error: (05/31/2015 00:42:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: dota.exe0.0.0.055601047unknown0.0.0.000000000c000000505d0bf805f401d09b1cfc734271G:\steam\steamapps\common\dota 2 beta\dota.exeunknown2725681d-071d-11e5-be9e-6cf04956b3bb

Error: (05/30/2015 11:04:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Steam.exe2.76.57.19b3401d09b1576846dd14294967295G:\steam\Steam.exe6649017b-070f-11e5-be9d-6cf04956b3bb

Error: (05/30/2015 11:03:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: dota.exe0.0.0.055601047unknown0.0.0.000000000c000000506afbf80110c01d09b1bb91f20f7G:\steam\steamapps\common\dota 2 beta\dota.exeunknown4fcf8f1a-070f-11e5-be9d-6cf04956b3bb


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz
Percentage of memory in use: 22%
Total physical RAM: 12279.42 MB
Available physical RAM: 9557.98 MB
Total Pagefile: 24567.42 MB
Available Pagefile: 21413.24 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:63.67 GB) NTFS
Drive f: (Programme/Daten) (Fixed) (Total:931.51 GB) (Free:723.96 GB) NTFS
Drive g: (Games) (Fixed) (Total:465.76 GB) (Free:431.98 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: CF858D58)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 5B34C089)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 5698EFF1)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End of log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-08 20:35:23
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000026 Samsung_SSD_840_PRO_Series rev.DXM06B0Q 119,24GB
Running: Gmer-19357.exe; Driver: C:\Users\Bobomb\AppData\Local\Temp\awryipog.sys


---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\system32\lsass.exe[664] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                     00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[816] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                   00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\System32\svchost.exe[280] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                   00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[336] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                   00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[436] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                   00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[1092] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                  00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[1412] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                  00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\SearchIndexer.exe[1140] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                            00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[4872] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                            00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\Explorer.EXE[6040] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                          00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\taskhostex.exe[5416] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                               00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\System32\svchost.exe[752] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                   00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\AUDIODG.EXE[1988] C:\WINDOWS\SYSTEM32\KERNEL32.DLL!GetBinaryTypeW + 165                                                  00007ff9d2f6d3c5 1 byte [62]
.text   C:\WINDOWS\system32\svchost.exe[4320] C:\WINDOWS\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                  00007ff9d2f6d3c5 1 byte [62]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [4080:2556]                                                                                                    fffff9600080b2d0
Thread  C:\WINDOWS\system32\csrss.exe [4080:5976]                                                                                                    fffff9600080b2d0

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{5BDD4354-0616-4A1B-86CF-20125443D05C}\Connection@Name  isatap.{D6948CFB-2443-421A-B174-EDA54EFD7116}
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                            -756171011
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{5BDD4354-0616-4A1B-86CF-20125443D05C}@InterfaceName                       isatap.{D6948CFB-2443-421A-B174-EDA54EFD7116}
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{5BDD4354-0616-4A1B-86CF-20125443D05C}@ReusableType                        0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{762A5DE9-1DE0-42C0-B4AC-B50FD623D3CC}@DefunctTimestamp                    0x10 0xBE 0x75 0x55 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                              4606
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                             2384
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile@EnableFirewall                                   1
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile@EnableFirewall                                 1
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@DhcpIPAddress                      0.0.0.0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@DhcpSubnetMask                     255.0.0.0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@DhcpServer                         255.255.255.255
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@LeaseObtainedTime                  1433712672
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@T1                                 1434144672
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@T2                                 1434468672
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@LeaseTerminatesTime                1434576672
Reg     HKLM\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters\Interfaces\{D6948CFB-2443-421A-B174-EDA54EFD7116}@Dhcpv6State                       1
Reg     HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                           0x64 0x62 0x03 0x00 ...
Reg     HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                       0x64 0x62 0x03 0x00 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\GWX\Usage@UsageTime                                                                           0x7E 0x4F 0xF3 0x02 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602@CachePrefix             :2015060120150602: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060120150602
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060120150602@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603@CachePrefix             :2015060220150603: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060220150603
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060220150603@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604@CachePrefix             :2015060320150604: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060320150604
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060320150604@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606@CachePrefix             :2015060520150606: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060520150606
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060520150606@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607@CachePrefix             :2015060620150607: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060620150607
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060620150607@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608                         
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608@CachePrefix             :2015060720150608: 
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608@CachePath               %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012015060720150608
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608@CacheOptions            11
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608@CacheRepair             0
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015060720150608@CacheLimit              8192
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Store@LastTileRefresh                                                                         0x9A 0x81 0x17 0xDA ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Store\RefreshBannedAppList@BannedAppsLastModified                                             0x80 0x75 0xBF 0x51 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC@0                                                                                     C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk?C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\Silverlight.Configuration.exe??

---- EOF - GMER 2.1 ----