| MacLewis | 09.01.2014 20:12 |
3 infizierte Dateien entdeckt
Hallo werte Experten,
Malwarebytes' Anti-Malware hat bei mir 3 infizierte Dateien entdeckt. Soweit haben diese aber keine merkbaren Auswirkung.
Wäre trotzdem super, wenn Ihr mal nen Blick drauf werft.
Hier alle Log Dateien: Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2014.01.09.05
Windows 8 x64 NTFS
Internet Explorer 11.0.9600.16476
***** :: ACID [Administrator]
09.01.2014 18:34:02
MBAM-log-2014-01-09 (19-24-34).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 414621
Laufzeit: 49 Minute(n), 34 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 3
C:\Users\*****\AppData\Local\Temp\parent.txt (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\*****\AppData\Local\Temp\worker.exe (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
C:\Users\*****\AppData\Local\Temp\94923394-b34f-47be-9cf2-02c84d9fbeb90\parent.txt (PUP.Optional.BundleInstaller.A) -> Keine Aktion durchgeführt.
(Ende)
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:54 on 09/01/2014 (JohannesKainer)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014 01
Ran by ***** (administrator) on ACID on 09-01-2014 19:56:05
Running from C:\Users\*****\Desktop
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
() C:\Windows\FixCamera.exe
() C:\Windows\tsnp2std.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(alch) C:\Program Files (x86)\ClamWin\bin\ClamTray.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Mindjet) C:\Program Files (x86)\Mindjet\MindManager 11\MmReminderService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [ASUSQuickGesture(x86)] - C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe [20352 2012-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [ASUSTPLoader(x64)] - C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe [169856 2012-09-11] (AsusTek)
HKLM\...\Run: [ASUSQuickGesture(x64)] - C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe [22400 2012-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [snp2std] - C:\Windows\vsnp2std.exe
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FixCamera] - C:\Windows\FixCamera.exe [20480 2007-07-11] ()
HKLM-x32\...\Run: [tsnp2std] - C:\Windows\tsnp2std.exe [270336 2007-05-12] ()
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [ClamWin] - C:\Program Files (x86)\ClamWin\bin\ClamTray.exe [86016 2013-04-27] (alch)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-13] (RealNetworks, Inc.)
HKLM-x32\...\Run: [MMReminderService] - C:\Program Files (x86)\Mindjet\MindManager 11\MmReminderService.exe [41864 2012-11-12] (Mindjet)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-12-10] ()
HKCU\...\Run: [EPSON SX420W Series] - C:\Windows\System32\spool\drivers\x64\3\E_IATIGCE.EXE [224768 2009-09-14] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Valve\Steam\Steam.exe [1823656 2013-12-11] (Valve Corporation)
HKCU\...\Run: [Speech Recognition] - C:\Windows\Speech\Common\sapisvr.exe [44544 2013-08-22] (Microsoft Corporation)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [457728 2013-09-30] (Microsoft Corporation)
HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe [455744 2013-12-10] (BillP Studios)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [168616 2013-09-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-09-27] (NVIDIA Corporation)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8C6DEC74585DCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope {A0E7EF7B-3DCA-4219-B3AC-07B46B6250AF} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {A0E7EF7B-3DCA-4219-B3AC-07B46B6250AF} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {A0E7EF7B-3DCA-4219-B3AC-07B46B6250AF} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {A0E7EF7B-3DCA-4219-B3AC-07B46B6250AF} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: ASUS Browser Extension x64 - {78234974-0C4B-4111-BDEB-D9A104418772} - C:\Program Files (x86)\ASUS\ASUS Smart Gesture\install\x64\BrowserExtension64.dll (ASUSTeK Computer Inc.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: CmjBrowserHelperObject Object - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll (Mindjet)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: ASUS Browser Extension x86 - {78234974-0C4B-4111-BDEB-D9A104418771} - C:\Program Files (x86)\ASUS\ASUS Smart Gesture\install\x86\BrowserExtension.dll (ASUSTeK Computer Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pofkhwr8.default-1375807313331
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Homepage: https://www.ixquick.com/
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\*****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pofkhwr8.default-1375807313331\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FoxyProxy Standard - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pofkhwr8.default-1375807313331\Extensions\foxyproxy@eric.h.jung
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pofkhwr8.default-1375807313331\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF StartMenuInternet: FIREFOX.EXE - C:\Users\*****\Desktop\Zeugs\Unterlagen\Bewerbung\Bewerbung bereits verschickt - KPMG - Trainee Transaction & Restructuring\FF\firefox.exe
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-27] (NVIDIA Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [x]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [x]
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R3 ArcSoftKsUFilter; C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [18688 2007-05-30] (ArcSoft, Inc.)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [56704 2012-09-11] (ASUS Corporation)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-01-03] (Disc Soft Ltd)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-09 19:56 - 2014-01-09 19:56 - 00020238 _____ C:\Users\*****\Desktop\FRST.txt
2014-01-09 19:56 - 2014-01-09 19:56 - 00000000 ____D C:\FRST
2014-01-09 19:54 - 2014-01-09 19:54 - 00000168 _____ C:\Users\*****\defogger_reenable
2014-01-09 19:27 - 2014-01-09 19:28 - 01931770 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2014-01-09 19:27 - 2014-01-09 19:27 - 00377856 _____ C:\Users\*****\Downloads\gmer_2.1.19163.exe
2014-01-09 19:25 - 2014-01-09 19:55 - 00000000 ____D C:\Users\*****\Desktop\Neuer Ordner
2014-01-08 21:12 - 2014-01-08 21:12 - 00002790 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-01-08 21:12 - 2014-01-08 21:12 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-08 21:12 - 2014-01-08 21:12 - 00000000 ____D C:\Program Files\CCleaner
2014-01-08 18:49 - 2014-01-09 18:34 - 00003320 _____ C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-06 16:16 - 2014-01-06 17:59 - 00012060 _____ C:\Users\*****\Desktop\Ausgaben.xlsm
2014-01-04 19:42 - 2014-01-04 19:42 - 00002908 _____ C:\Users\Public\Desktop\Mindjet.lnk
2014-01-04 19:42 - 2014-01-04 19:42 - 00000000 ____D C:\ProgramData\Mindjet
2014-01-04 19:40 - 2014-01-04 19:40 - 00000000 ____D C:\Users\*****\AppData\Local\{250B3DB2-4235-4280-8724-04DB9571543D}
2014-01-04 19:16 - 2014-01-04 21:12 - 00000000 ____D C:\Users\*****\Desktop\3D - Spareprinter
2014-01-03 01:14 - 2014-01-03 01:14 - 00283064 _____ (Disc Soft Ltd) C:\WINDOWS\system32\Drivers\dtsoftbus01.sys
2014-01-03 01:14 - 2014-01-03 01:14 - 00001966 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2014-01-03 01:14 - 2014-01-03 01:14 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2014-01-03 01:06 - 2014-01-03 01:06 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-12-30 14:50 - 2014-01-06 19:57 - 00003350 _____ C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2013-12-29 21:45 - 2013-12-29 21:45 - 00000981 _____ C:\Users\*****\Desktop\Unlocker.lnk
2013-12-29 21:43 - 2013-12-29 21:43 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2013-12-29 21:43 - 2013-12-29 21:43 - 00000000 ____D C:\Program Files\Unlocker
2013-12-26 17:09 - 2013-12-26 17:09 - 00000000 ____D C:\Users\*****\Documents\MAGIX
2013-12-26 17:08 - 2014-01-08 19:42 - 00000000 ____D C:\Program Files (x86)\MAGIX
2013-12-26 17:08 - 2013-12-26 17:09 - 00000000 ____D C:\ProgramData\MAGIX
2013-12-26 16:59 - 2013-12-26 17:09 - 00000000 ____D C:\Users\*****\AppData\Roaming\MAGIX
2013-12-26 16:55 - 2013-12-26 16:57 - 00000000 ____D C:\Users\*****\.DVDslideshowGUI
2013-12-26 16:55 - 2013-12-26 16:57 - 00000000 ____D C:\Program Files (x86)\DVD slideshow GUI
2013-12-26 16:55 - 2013-12-26 16:55 - 00034936 _____ C:\WINDOWS\SysWOW64\uninstHelixYUV.exe
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\Haali
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\AvsP
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2013-12-26 16:54 - 2013-12-26 16:55 - 07760687 _____ (Boraxsoft) C:\Users\*****\AppData\Roaming\SetupGFD.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 05243208 _____ ( ) C:\Users\*****\AppData\Roaming\AvsP.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 01357348 _____ C:\Users\*****\AppData\Roaming\MatroskaSplitter.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 00117723 _____ C:\Users\*****\AppData\Roaming\yuvcodecs-1.3.exe
2013-12-26 16:53 - 2013-12-26 16:54 - 05514668 _____ (LIGHTNING UK!) C:\Users\*****\AppData\Roaming\Imgburn.exe
2013-12-26 16:53 - 2013-12-26 16:53 - 05082084 _____ (The Public) C:\Users\*****\AppData\Roaming\Avisynth.exe
2013-12-21 19:13 - 2013-12-21 19:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 18:53 - 2014-01-09 18:34 - 00003372 _____ C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2013-12-17 04:25 - 2013-12-17 04:25 - 00002232 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-16 13:55 - 2013-12-16 13:55 - 00000000 ____D C:\WINDOWS\SysWOW64\xlive
2013-12-16 13:55 - 2013-12-16 13:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2013-12-15 21:09 - 2013-11-23 05:34 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2013-12-15 21:09 - 2013-11-23 05:13 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2013-12-15 21:09 - 2013-11-23 04:32 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2013-12-15 21:09 - 2013-11-23 04:10 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2013-12-15 21:09 - 2013-11-09 07:34 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2013-12-15 21:09 - 2013-11-09 07:34 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2013-12-15 21:09 - 2013-11-09 06:52 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2013-12-15 14:33 - 2013-12-15 14:33 - 00000000 ____D C:\WINDOWS\PCHEALTH
2013-12-15 14:28 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-12-15 14:28 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-12-15 14:28 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-12-15 14:28 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-12-15 14:28 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-12-15 14:28 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-12-15 14:28 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-12-15 14:28 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-12-15 14:28 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-12-15 14:28 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2013-12-15 14:28 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-12-15 14:28 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-12-15 14:28 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-12-15 14:28 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2013-12-15 14:28 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2013-12-15 14:28 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-12-15 14:28 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-12-15 14:27 - 2013-11-12 00:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-15 14:27 - 2013-11-12 00:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-15 14:27 - 2013-11-12 00:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-12-15 14:27 - 2013-11-12 00:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-12-15 14:27 - 2013-11-11 03:48 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2013-12-15 14:27 - 2013-11-09 12:55 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2013-12-15 14:27 - 2013-11-09 07:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2013-12-15 14:27 - 2013-11-09 06:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2013-12-15 14:27 - 2013-11-08 11:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2013-12-15 14:27 - 2013-11-08 08:21 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2013-12-15 14:27 - 2013-11-08 05:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2013-12-15 14:27 - 2013-11-08 05:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2013-12-15 14:27 - 2013-11-08 05:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2013-12-15 14:27 - 2013-11-08 05:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2013-12-15 14:27 - 2013-11-08 05:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2013-12-15 14:27 - 2013-11-08 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2013-12-15 14:27 - 2013-11-08 04:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2013-12-15 14:27 - 2013-11-08 04:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2013-12-15 14:27 - 2013-11-05 15:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2013-12-15 14:27 - 2013-11-05 15:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2013-12-15 14:27 - 2013-11-05 14:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2013-12-15 14:27 - 2013-11-05 14:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2013-12-15 14:27 - 2013-11-05 14:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2013-12-15 14:27 - 2013-11-04 18:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-12-15 14:27 - 2013-11-04 18:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-12-15 14:27 - 2013-11-04 14:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2013-12-15 14:27 - 2013-11-04 12:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-12-15 14:27 - 2013-11-04 11:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2013-12-15 14:27 - 2013-11-04 03:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2013-12-15 14:27 - 2013-11-04 02:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-12-15 14:27 - 2013-11-01 12:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2013-12-15 14:27 - 2013-11-01 07:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2013-12-15 14:27 - 2013-11-01 06:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2013-12-15 14:27 - 2013-10-31 01:58 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2013-12-15 14:27 - 2013-10-31 01:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2013-12-15 14:27 - 2013-10-31 01:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2013-12-15 14:27 - 2013-10-31 01:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2013-12-15 14:27 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2013-12-15 14:27 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2013-12-15 14:27 - 2013-10-26 02:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2013-12-15 14:27 - 2013-10-24 10:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2013-12-15 14:27 - 2013-10-24 10:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2013-12-15 14:27 - 2013-10-17 12:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-12-15 14:27 - 2013-10-17 11:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-12-15 14:27 - 2013-10-05 15:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-12-15 14:27 - 2013-10-05 15:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-12-15 14:27 - 2013-10-05 13:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-12-15 14:27 - 2013-10-05 13:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-12-15 14:26 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2013-12-15 14:26 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2013-12-15 14:26 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2013-12-15 14:26 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
==================== One Month Modified Files and Folders =======
2014-01-09 19:56 - 2014-01-09 19:56 - 00020238 _____ C:\Users\*****\Desktop\FRST.txt
2014-01-09 19:56 - 2014-01-09 19:56 - 00000000 ____D C:\FRST
2014-01-09 19:55 - 2014-01-09 19:25 - 00000000 ____D C:\Users\*****\Desktop\Neuer Ordner
2014-01-09 19:54 - 2014-01-09 19:54 - 00000168 _____ C:\Users\*****\defogger_reenable
2014-01-09 19:54 - 2013-11-05 15:10 - 00000000 ____D C:\Users\*****
2014-01-09 19:28 - 2014-01-09 19:27 - 01931770 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2014-01-09 19:27 - 2014-01-09 19:27 - 00377856 _____ C:\Users\*****\Downloads\gmer_2.1.19163.exe
2014-01-09 19:23 - 2013-04-12 12:52 - 00001136 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-09 19:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-09 18:36 - 2012-12-10 21:55 - 00000000 ____D C:\Users\*****\AppData\Local\PMB Files
2014-01-09 18:34 - 2014-01-08 18:49 - 00003320 _____ C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-09 18:34 - 2013-12-18 18:53 - 00003372 _____ C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-09 18:10 - 2013-11-05 15:05 - 01847209 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-09 18:06 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-09 18:06 - 2013-04-12 12:52 - 00001132 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-09 18:04 - 2013-01-21 19:55 - 00000000 ____D C:\Users\*****\Documents\Outlook-Dateien
2014-01-08 21:12 - 2014-01-08 21:12 - 00002790 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-01-08 21:12 - 2014-01-08 21:12 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-08 21:12 - 2014-01-08 21:12 - 00000000 ____D C:\Program Files\CCleaner
2014-01-08 20:01 - 2012-12-10 18:57 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-08 19:42 - 2013-12-26 17:08 - 00000000 ____D C:\Program Files (x86)\MAGIX
2014-01-08 19:41 - 2013-10-03 20:18 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2014-01-08 19:37 - 2012-12-10 21:36 - 00000000 ____D C:\Users\*****\Desktop\Zeugs
2014-01-06 19:58 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2014-01-06 19:57 - 2013-12-30 14:50 - 00003350 _____ C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-06 19:57 - 2012-12-12 11:44 - 00003298 _____ C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3797833307-1882079770-3084119189-1001
2014-01-06 18:00 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2014-01-06 17:59 - 2014-01-06 16:16 - 00012060 _____ C:\Users\*****\Desktop\Ausgaben.xlsm
2014-01-06 16:14 - 2013-09-30 05:14 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-06 16:14 - 2013-09-30 04:56 - 00765582 _____ C:\WINDOWS\system32\perfh007.dat
2014-01-06 16:14 - 2013-09-30 04:56 - 00159366 _____ C:\WINDOWS\system32\perfc007.dat
2014-01-05 23:51 - 2012-12-10 21:42 - 00000000 ____D C:\Users\*****\AppData\Local\Paint.NET
2014-01-05 00:05 - 2013-08-22 15:44 - 00484760 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2014-01-05 00:04 - 2013-09-29 20:04 - 00005706 _____ C:\WINDOWS\PFRO.log
2014-01-04 21:12 - 2014-01-04 19:16 - 00000000 ____D C:\Users\*****\Desktop\3D - Spareprinter
2014-01-04 19:44 - 2013-09-30 20:43 - 00000000 ____D C:\ProgramData\InstallMate
2014-01-04 19:43 - 2013-01-07 14:10 - 00000000 ____D C:\Users\*****\Documents\Eigene Maps
2014-01-04 19:42 - 2014-01-04 19:42 - 00002908 _____ C:\Users\Public\Desktop\Mindjet.lnk
2014-01-04 19:42 - 2014-01-04 19:42 - 00000000 ____D C:\ProgramData\Mindjet
2014-01-04 19:42 - 2013-01-07 14:09 - 00000000 ____D C:\Program Files (x86)\Mindjet
2014-01-04 19:40 - 2014-01-04 19:40 - 00000000 ____D C:\Users\*****\AppData\Local\{250B3DB2-4235-4280-8724-04DB9571543D}
2014-01-03 14:28 - 2013-04-12 12:52 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-03 01:14 - 2014-01-03 01:14 - 00283064 _____ (Disc Soft Ltd) C:\WINDOWS\system32\Drivers\dtsoftbus01.sys
2014-01-03 01:14 - 2014-01-03 01:14 - 00001966 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2014-01-03 01:14 - 2014-01-03 01:14 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2014-01-03 01:06 - 2014-01-03 01:06 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2014-01-01 23:12 - 2013-10-03 20:17 - 00000887 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-12-29 21:45 - 2013-12-29 21:45 - 00000981 _____ C:\Users\*****\Desktop\Unlocker.lnk
2013-12-29 21:43 - 2013-12-29 21:43 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2013-12-29 21:43 - 2013-12-29 21:43 - 00000000 ____D C:\Program Files\Unlocker
2013-12-29 21:38 - 2013-08-22 15:46 - 00345652 _____ C:\WINDOWS\setupact.log
2013-12-28 05:05 - 2013-11-19 17:43 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2013-12-26 17:09 - 2013-12-26 17:09 - 00000000 ____D C:\Users\*****\Documents\MAGIX
2013-12-26 17:09 - 2013-12-26 17:08 - 00000000 ____D C:\ProgramData\MAGIX
2013-12-26 17:09 - 2013-12-26 16:59 - 00000000 ____D C:\Users\*****\AppData\Roaming\MAGIX
2013-12-26 16:57 - 2013-12-26 16:55 - 00000000 ____D C:\Users\*****\.DVDslideshowGUI
2013-12-26 16:57 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\DVD slideshow GUI
2013-12-26 16:55 - 2013-12-26 16:55 - 00034936 _____ C:\WINDOWS\SysWOW64\uninstHelixYUV.exe
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\Haali
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\AvsP
2013-12-26 16:55 - 2013-12-26 16:55 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2013-12-26 16:55 - 2013-12-26 16:54 - 07760687 _____ (Boraxsoft) C:\Users\*****\AppData\Roaming\SetupGFD.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 05243208 _____ ( ) C:\Users\*****\AppData\Roaming\AvsP.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 01357348 _____ C:\Users\*****\AppData\Roaming\MatroskaSplitter.exe
2013-12-26 16:54 - 2013-12-26 16:54 - 00117723 _____ C:\Users\*****\AppData\Roaming\yuvcodecs-1.3.exe
2013-12-26 16:54 - 2013-12-26 16:53 - 05514668 _____ (LIGHTNING UK!) C:\Users\*****\AppData\Roaming\Imgburn.exe
2013-12-26 16:53 - 2013-12-26 16:53 - 05082084 _____ (The Public) C:\Users\*****\AppData\Roaming\Avisynth.exe
2013-12-22 13:23 - 2012-12-10 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-21 19:14 - 2013-12-21 19:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-17 04:25 - 2013-12-17 04:25 - 00002232 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-12-16 13:55 - 2013-12-16 13:55 - 00000000 ____D C:\WINDOWS\SysWOW64\xlive
2013-12-16 13:55 - 2013-12-16 13:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2013-12-15 22:10 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2013-12-15 17:14 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2013-12-15 17:14 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore
2013-12-15 17:14 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2013-12-15 17:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\FileManager
2013-12-15 17:13 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera
2013-12-15 14:33 - 2013-12-15 14:33 - 00000000 ____D C:\WINDOWS\PCHEALTH
2013-12-15 14:33 - 2013-08-14 12:21 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-15 14:33 - 2013-01-16 14:08 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 14:32 - 2012-12-23 20:51 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\bdfilters.dll
C:\Users\*****\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\*****\AppData\Local\Temp\vlc-2.1.1-win64.exe
C:\Users\*****\AppData\Local\Temp\vlc-2.1.2-win64.exe
C:\Users\*****\AppData\Local\Temp\worker.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-09 19:24
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2014 01
Ran by ***** at 2014-01-09 19:56:27
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.5.146 - Adobe Systems, Inc.)
ASUS Smart Gesture (x32 Version: 1.0.32 - ASUS)
ATK Package (x32 Version: 1.0.0022 - ASUS)
AviSynth 2.6 (x32 Version: 2.6.0.2 - GPL Public release.)
AvsP (x32 Version: - )
Bandicam (x32 Version: 1.9.2.454 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (x32 Version: - Bandisoft.com)
CCleaner (Version: 4.09 - Piriform)
CDBurnerXP (x32 Version: 4.5.2.4291 - CDBurnerXP)
Citrix Online Launcher (x32 Version: 1.0.122 - Citrix)
ClamWin Free Antivirus 0.97.8 (x32 Version: - alch)
Command & Conquer Die ersten 10 Jahre (x32 Version: 1.00.0000 - Electronic Arts)
Counter-Strike(TM) (x32 Version: 1.0.0.0 - Valve)
DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
Dropbox (HKCU Version: 1.6.16 - Dropbox, Inc.)
Epson Easy Photo Print 2 (x32 Version: 2.2.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (x32 Version: 2.40.0001 - SEIKO EPSON CORPORATION)
EPSON Scan (x32 Version: - Seiko Epson Corporation)
EPSON SX420W Series Handbuch (x32 Version: - )
EPSON SX420W Series Netzwerk-Handbuch (x32 Version: - )
EPSON SX420W Series Printer Uninstall (Version: - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.4i - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.2 (x32 Version: 3.2a - SEIKO EPSON CORPORATION)
FIFA 10 (x32 Version: 1.0.0.0 - Electronic Arts)
Free YouTube to MP3 Converter version 3.12.17.1125 (x32 Version: 3.12.17.1125 - DVDVideoSoft Ltd.)
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
GoToMeeting 5.9.0.1207 (HKCU Version: 5.9.0.1207 - CitrixOnline)
Grand Theft Auto IV (x32 Version: - Rockstar Games)
Grand Theft Auto IV (x32 Version: 1.0.0013.131 - Rockstar Games Inc.) Hidden
Grand Theft Auto IV (x32 Version: 1.00.0000 - Rockstar Games)
Haali Media Splitter (x32 Version: - )
hama PC-Webcam Messenger Set II (x32 Version: 5.7.19104.101 - Sonix)
Hama Webcam Suite (x32 Version: - ArcSoft)
Helix YUV Codecs (remove only) (x32 Version: - )
ImgBurn (x32 Version: 2.5.5.0 - LIGHTNING UK!)
Intel(R) Processor Graphics (x32 Version: 10.18.10.3308 - Intel Corporation)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mindjet (x32 Version: 11.1.353 - Mindjet)
MozBackup 1.5.1 (x32 Version: - Pavel Cvrcek)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA GeForce Experience 1.6.1 (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.40 (Version: 331.40 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.889 - NVIDIA Corporation) Hidden
NVIDIA Optimus 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Systemsteuerung 331.40 (Version: 331.40 - NVIDIA Corporation) Hidden
NVIDIA Update 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.5 (Version: 1.2.5 - NVIDIA Corporation)
Of Orcs and Men (x32 Version: 1.0.0.2 - Cyanide)
Paint.NET v3.5.11 (Version: 3.61.0 - dotPDN LLC)
Pando Media Booster (x32 Version: 2.6.0.8 - Pando Networks Inc.)
PDF Architect (x32 Version: 1.0.41.8362 - pdfforge)
PDFCreator (x32 Version: 1.6.1 - pdfforge)
PDF-XChange 3 (Version: - Tracker Software)
Qualcomm Atheros Client Installation Program (x32 Version: 10.0 - Qualcomm Atheros)
RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (x32 Version: 16.0.3 - RealNetworks)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Skype™ 6.10 (x32 Version: 6.10.104 - Skype Technologies S.A.)
Steam(TM) (x32 Version: 1.0.0.0 - Valve)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (Version: 3.0.10.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (x32 Version: 8.0.20202 - TeamViewer)
Unlocker 1.9.2 (Version: 1.9.2 - Cedrick Collomb)
Unreal Anthology (x32 Version: 1.00.0000 - Epic Games, Inc.)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
Update for Video Converter (HKCU Version: - ) <==== ATTENTION
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
Windows-Treiberpaket - ASUS (ATP) Mouse (08/27/2012 1.0.0.125) (Version: 08/27/2012 1.0.0.125 - ASUS)
WinPatrol (Version: 28.9.2013.1 - BillP Studios)
WinPatrol (Version: 29.2.2013 - BillP Studios)
==================== Restore Points =========================
29-12-2013 20:55:26 Geplanter Prüfpunkt
03-01-2014 00:05:52 Installed MSXML 4.0 SP3 Parser
04-01-2014 18:41:03 Installed Mindjet.
==================== Hosts content: ==========================
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {14F13BB0-2289-488F-9824-7F61F006DD3C} - \EPUpdater No Task File
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {22101784-5A83-4EFC-B36C-DA81CA9D9F30} - \BitGuard No Task File
Task: {28424731-B4EE-4226-9186-C01297C98520} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {39FB27B7-7B87-4B44-A3BE-3EA34DA8ED0C} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\System32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6CA21751-263F-448C-A7D1-65E3B3CB0D5A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {97E9FC23-5E55-4F12-86B2-4172448111B3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A47AB1AB-DBF4-4519-A994-9EB70A1DD26C} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3797833307-1882079770-3084119189-1001 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B58B92D1-C94D-4FC7-B80C-9ACA9A7D0791} - \DSite No Task File
Task: {C76AE55B-CDF7-4A5C-858A-35523E525724} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3797833307-1882079770-3084119189-1001 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D270DD2D-6084-4096-8077-652D883452F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {E8B5A8EE-BA3D-463E-9FAC-4AD6A5717DDA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3797833307-1882079770-3084119189-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-03 20:12 - 2013-09-27 09:57 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-10-01 13:02 - 2013-10-01 13:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-03 20:12 - 2013-09-27 09:57 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-30 20:43 - 2013-07-15 18:29 - 00620718 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2012-12-24 16:46 - 2005-02-08 16:23 - 00979005 _____ () C:\Program Files (x86)\ClamWin\bin\python23.dll
2012-12-24 16:46 - 2004-11-20 02:27 - 00069632 _____ () C:\Program Files (x86)\ClamWin\lib\win32api.pyd
2012-12-24 16:46 - 2004-10-11 19:21 - 00094208 _____ () C:\Program Files (x86)\ClamWin\lib\pywintypes23.dll
2012-12-24 16:46 - 2004-05-25 20:18 - 00057401 _____ () C:\Program Files (x86)\ClamWin\lib\_sre.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00086016 _____ () C:\Program Files (x86)\ClamWin\lib\win32gui.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00024576 _____ () C:\Program Files (x86)\ClamWin\lib\win32event.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00036864 _____ () C:\Program Files (x86)\ClamWin\lib\win32process.pyd
2012-12-24 16:46 - 2004-05-25 20:18 - 00049212 _____ () C:\Program Files (x86)\ClamWin\lib\_socket.pyd
2012-12-24 16:46 - 2004-05-25 20:18 - 00495616 _____ () C:\Program Files (x86)\ClamWin\lib\_ssl.pyd
2012-12-24 16:46 - 2004-05-25 20:20 - 00036864 _____ () C:\Program Files (x86)\ClamWin\lib\_winreg.pyd
2012-12-24 16:46 - 2004-10-11 19:22 - 00315392 _____ () C:\Program Files (x86)\ClamWin\lib\pythoncom23.dll
2012-12-24 16:46 - 2004-11-20 02:27 - 00106496 _____ () C:\Program Files (x86)\ClamWin\lib\shell.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00065536 _____ () C:\Program Files (x86)\ClamWin\lib\win32security.pyd
2012-12-24 16:46 - 2004-01-15 13:45 - 00061440 _____ () C:\Program Files (x86)\ClamWin\lib\_ctypes.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00077824 _____ () C:\Program Files (x86)\ClamWin\lib\win32file.pyd
2012-12-24 16:46 - 2004-11-20 02:27 - 00024576 _____ () C:\Program Files (x86)\ClamWin\lib\win32pipe.pyd
2012-12-24 16:46 - 2003-10-01 12:40 - 02240512 _____ () C:\Program Files (x86)\ClamWin\lib\wxc.pyd
2012-12-24 16:46 - 2003-10-01 10:43 - 03239936 _____ () C:\Program Files (x86)\ClamWin\lib\wxmsw24h.dll
2012-12-24 16:46 - 2003-08-10 08:14 - 00061440 _____ () C:\Program Files (x86)\ClamWin\lib\mxDateTime.pyd
2012-12-24 16:46 - 2004-05-25 20:17 - 00622651 _____ () C:\Program Files (x86)\ClamWin\lib\_bsddb.pyd
2012-12-24 16:46 - 2004-05-25 20:19 - 00045117 _____ () C:\Program Files (x86)\ClamWin\lib\datetime.pyd
2012-11-12 04:48 - 2012-11-12 04:48 - 00151408 _____ () C:\Program Files (x86)\Mindjet\MindManager 11\zlib.dll
2013-12-21 19:13 - 2013-12-21 19:13 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/09/2014 07:35:09 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/09/2014 03:08:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/09/2014 03:02:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/08/2014 08:03:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/08/2014 06:36:05 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 26.0.0.5087 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11e8
Startzeit: 01cf0c91361068dc
Endzeit: 4294967295
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: 58ecfa67-788b-11e3-8170-50465dd0cdc9
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (01/06/2014 08:18:05 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/06/2014 08:12:23 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/06/2014 07:10:00 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/06/2014 04:37:11 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/06/2014 04:31:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (01/09/2014 06:10:16 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (01/09/2014 06:08:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/09/2014 03:02:43 PM) (Source: DCOM) (User: Acid)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/09/2014 03:02:13 PM) (Source: DCOM) (User: Acid)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/09/2014 10:00:03 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (01/08/2014 09:42:05 PM) (Source: Service Control Manager) (User: )
Description: Dienst "ASLDR Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/08/2014 08:02:55 PM) (Source: DCOM) (User: Acid)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/08/2014 08:02:25 PM) (Source: DCOM) (User: Acid)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/08/2014 06:43:04 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (01/08/2014 06:39:13 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (01/09/2014 07:35:09 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/09/2014 03:08:02 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/09/2014 03:02:29 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/08/2014 08:03:03 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/08/2014 06:36:05 PM) (Source: Application Hang)(User: )
Description: firefox.exe26.0.0.508711e801cf0c91361068dc4294967295C:\Program Files (x86)\Mozilla Firefox\firefox.exe58ecfa67-788b-11e3-8170-50465dd0cdc9
Error: (01/06/2014 08:18:05 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/06/2014 08:12:23 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/06/2014 07:10:00 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/06/2014 04:37:11 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
Error: (01/06/2014 04:31:43 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe
CodeIntegrity Errors:
===================================
Date: 2013-12-15 22:09:16.093
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:15.921
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.514
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.467
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.436
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.420
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.373
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:09:12.139
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2013-12-15 22:02:55.634
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Percentage of memory in use: 33%
Total physical RAM: 6023.11 MB
Available physical RAM: 4025.86 MB
Total Pagefile: 6983.11 MB
Available Pagefile: 4761.16 MB
Total Virtual: 131072 MB
Available Virtual: 131071.77 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.24 GB) (Free:325.77 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: A5135A6B)
Partition: GPT Partition Type
==================== End Of Log ============================
Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-09 20:02:35
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000038 Hitachi_HTS545050A7E380 rev.GG2OA6C0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\JOHANN~1\AppData\Local\Temp\pxldrpob.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffdaa1830e0 7 bytes JMP 00007ffea7a902d0
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffdaa184478 7 bytes JMP 00007ffea7a90308
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffdaa2311a8 7 bytes JMP 00007ffea7a90340
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffdaa23121c 7 bytes JMP 00007ffea7a903b0
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffdaa231668 7 bytes JMP 00007ffea7a90378
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007ffdaa2372d0 7 bytes JMP 00007ffea7a90260
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffdaa25d5a4 7 bytes JMP 00007ffea7a90228
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffdaa25d614 7 bytes JMP 00007ffea7a90298
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffda7aa2124 7 bytes JMP 00007ffea7a900d8
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffda7aa50e8 5 bytes JMP 00007ffea7a90180
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffda7aa52a0 5 bytes JMP 00007ffea7a90148
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffda7aaa9b0 5 bytes JMP 00007ffea7a90110
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffda91c7b64 10 bytes JMP 00007ffea7a90490
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffda91e2910 5 bytes JMP 00007ffea7a90420
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffda91e4578 5 bytes JMP 00007ffea7a90458
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffda91e4980 9 bytes JMP 00007ffea7a903e8
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffda9ab1500 8 bytes JMP 00007ffea7a901b8
.text C:\WINDOWS\system32\dwm.exe[916] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffda9ab1750 8 bytes JMP 00007ffea7a901f0
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
WICHTIG: Während ich GMER habe laufen lassen, erschienen folgende Meldungen:
Kein Zugriff auf config\system
Kein Zugriff auf ntuser.dat
und "scan has been stopped"
Vorab besten Dank! Ihr habt mir schon so häufig geholfen. Ihr seid echt die Besten!
Gruß
MacLewis |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
