Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Gruppenrichtlinie blockiert G-Data nach Virenfund (https://www.trojaner-board.de/156924-gruppenrichtlinie-blockiert-g-data-virenfund.html)

schrauber 31.07.2014 22:43

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

sheldon299 03.08.2014 14:08
log.txt:
Code:
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=9d9e11ba9cdb9341833afab2624e29bb
# engine=19476
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-03 12:32:48
# local_time=2014-08-03 02:32:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 244266 158699018 0 0
# scanned=1983
# found=3
# cleaned=0
# scan_time=2260
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"
sh=B58D5AA8A12DDB74DDE97C9541B2242941BA4E3B ft=1 fh=77045453f77bcb91 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Components\NCHToolbars\conduit\ConduitInstaller.exe.vir"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Christian\AppData\Local\Conduit\CT2801948\NCH_ENAutoUpdateHelper.exe.vir"
checkup.txt:
Code:
Results of screen317's Security Check version 0.99.85 
 Windows 7 Service Pack 1 x64 (UAC is disabled!) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity CBE 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java(TM) 6 Update 30 
 Java version out of Date!
 Adobe Reader 9 Adobe Reader out of Date!
 Google Chrome 35.0.1916.153 
 Google Chrome 36.0.1985.125 
````````Process Check: objlist.exe by Laurent```````` 
 G Data InternetSecurity Firewall GDFwSvcx64.exe
 G Data InternetSecurity Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 01
Ran by Christian (administrator) on CHRISTIAN-PC on 03-08-2014 15:08:27
Running from C:\Users\Christian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Egis Technology Inc. ) C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimeLineAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\GUI\GDSC.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Peter Lorenz) C:\Program Files (x86)\Mediapurge\MediaPurge.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - (No Name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

schrauber 04.08.2014 09:27
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Java und Adobe updatne.



Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

sheldon299 04.08.2014 12:35
Fixlog.txt:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-07-2014 01
Ran by Christian at 2014-08-04 12:58:52 Run:2
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
*****************

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} => Value not found.

==== End of Fixlog ====
Vilen Dank erst mal, es hat alles soweit funktioniert. Jedoch öffnet sich bei jedem Hochfahren folgender Ordner "C:\Windows\SysWOW64".

schrauber 05.08.2014 06:19
Dann poste bitte nochmal ein frisches FRST logfile.

sheldon299 05.08.2014 10:09

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Christian (administrator) on CHRISTIAN-PC on 05-08-2014 10:54:37
Running from C:\Users\Christian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Egis Technology Inc. ) C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimeLineAgent.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Acer Inc.) C:\Program Files (x86)\Acer\clear.fi Client\ExtractDeviceIcon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVK.exe
(Code::Blocks Team) C:\Program Files (x86)\CodeBlocks\codeblocks.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\mpas-d_bd_1.179.1796.0.exe
(Microsoft Corporation) C:\de197fa36b8b1c25f8f891b69b4168\MpMiniSigStub.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [224128 2014-06-16] (Oracle Corporation)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - (No Name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Christian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox
FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2011-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore

Chrome:
=======
CHR HomePage:
CHR NewTab: "chrome-extension://eooncjejnppfjjklapaamhcdmjbilmde/redirect.html",
                                "chrome-extension://amfclgbdpgndipgoegfpkkgobahigbcl/redirect.html"
CHR DefaultSearchKeyword: delta-search.com
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\gcswf32.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Christian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (YouTube) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-17]
CHR Extension: (Google-Suche) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-17]
CHR Extension: (Google Wallet) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Google Mail) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2010-11-18] (Advanced Micro Devices, Inc.) [File not signed]
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
R2 GenieTimelineService; C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe [678464 2013-12-08] (Genie9)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [257344 2010-11-12] (NTI Corporation)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [807896 2012-05-21] (Mister Group)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2011-11-04] (www.winchiphead.com)
S3 DLPortIO; C:\Windows\SysWOW64\DRIVERS\DLPortIO.SYS [3584 2000-06-29] () [File not signed]
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-07-26] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-07-26] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-07-26] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-05-17] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-28] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-07-26] (G Data Software AG)
S2 hwpsgt; C:\Windows\SysWOW64\DRIVERS\hwpsgt.sys [137344 2011-07-13] () [File not signed]
S2 lemsgt; C:\Windows\SysWOW64\DRIVERS\lemsgt.sys [9472 2011-07-13] () [File not signed]
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2013-09-02] (hxxp://libusb-win32.sourceforge.net)
S3 rsvcdwdr; C:\Windows\System32\DRIVERS\rsvcdwdr.sys [45160 2011-11-17] (RapidSolution Software AG)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
S2 TVicPort; No ImagePath
R1 usedisk; C:\Windows\System32\DRIVERS\usedisk.sys [29208 2014-02-27] (Gili Soft INC.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-08-31] (Jungo)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Ser2pl; system32\DRIVERS\ser2pl64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 10:54 - 2014-08-05 10:57 - 00017704 _____ () C:\Users\Christian\Desktop\FRST.txt
2014-08-05 10:53 - 2014-08-05 10:55 - 00000000 ____D () C:\FRST
2014-08-05 10:51 - 2014-08-05 10:51 - 02094080 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2014-08-04 13:19 - 2014-08-04 13:20 - 00001069 _____ () C:\DelFix.txt
2014-07-31 13:59 - 2014-08-03 18:22 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\MediaPurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediapurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Program Files (x86)\Mediapurge
2014-07-31 13:58 - 2014-07-31 13:58 - 04040455 _____ () C:\Users\Christian\Downloads\Mediapurge556installer.exe
2014-07-31 13:58 - 2014-07-31 13:58 - 00000000 ____D () C:\Users\Christian\Downloads\Trojaner-Board
2014-07-31 10:05 - 2014-08-04 13:19 - 00000000 ____D () C:\Windows\ERUNT
2014-07-31 09:39 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-30 20:33 - 2014-07-30 22:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 20:32 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 20:32 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-29 17:43 - 2014-08-04 13:15 - 00000000 ____D () C:\Windows\erdnt
2014-07-29 10:56 - 2014-07-29 10:55 - 00321448 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00191400 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00190888 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-07-29 10:55 - 2014-07-29 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-29 10:54 - 2014-07-29 10:54 - 00000000 ____D () C:\Program Files\Java
2014-07-29 10:40 - 2014-07-29 10:40 - 00000000 ____D () C:\Users\Christian\.structorizer
2014-07-28 17:41 - 2014-07-28 17:41 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Acer
2014-07-28 17:38 - 2014-07-28 17:39 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Games
2014-07-28 17:38 - 2014-07-28 17:38 - 00000622 _____ () C:\Users\Elisabeth & Franz.Christian-PC\Desktop\Solitär.lnk
2014-07-28 17:37 - 2014-07-28 17:37 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Duden
2014-07-28 17:36 - 2014-07-28 17:36 - 00166880 _____ () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Macromedia
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Adobe
2014-07-28 17:35 - 2014-07-28 17:35 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Google
2014-07-28 17:33 - 2014-07-29 21:55 - 00000680 __RSH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.pol
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\CyberLink
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\PowerCinema
2014-07-28 17:31 - 2014-07-29 21:55 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC
2014-07-28 17:31 - 2014-07-28 17:31 - 00000020 ___SH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.ini
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Vorlagen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Startmenü
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Netzwerkumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Lokale Einstellungen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Eigene Dateien
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Druckumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Musik
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Bilder
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Verlauf
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Anwendungsdaten
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Anwendungsdaten
2014-07-28 17:31 - 2014-02-17 15:30 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Genie9
2014-07-28 17:31 - 2013-09-23 16:19 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Visual Studio 2010
2014-07-28 17:31 - 2011-11-16 10:30 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Help
2014-07-28 17:31 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-28 17:31 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-28 17:22 - 2014-08-05 10:36 - 00001120 _____ () C:\Windows\setupact.log
2014-07-28 17:22 - 2014-07-28 17:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-28 17:21 - 2014-08-03 15:49 - 00016320 _____ () C:\Windows\PFRO.log
2014-07-28 17:09 - 2014-07-29 11:13 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-28 17:09 - 2014-07-28 17:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-28 17:07 - 2014-07-28 17:07 - 04813544 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup416.exe
2014-07-28 13:56 - 2014-07-28 13:56 - 00000573 _____ () C:\Users\Christian\Desktop\Programmers Notepad [WinAVR].lnk
2014-07-28 12:44 - 2014-07-28 12:44 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-07-28 12:44 - 2014-07-28 12:44 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-07-28 11:57 - 2014-07-28 11:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-27 15:54 - 2014-07-27 16:00 - 251170997 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x64-RefreshPkg.msu
2014-07-27 15:44 - 2014-07-27 15:50 - 241162581 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x86-RefreshPkg.msu
2014-07-27 15:02 - 2014-07-27 15:02 - 00003132 _____ () C:\Windows\System32\Tasks\{921BBC8D-8938-456B-B469-E310D9DA4059}
2014-07-27 10:46 - 2014-07-27 10:49 - 05125829 _____ () C:\Users\Christian\Downloads\ccsetup416.zip
2014-07-27 09:51 - 2014-07-27 09:51 - 00000017 _____ () C:\Users\Christian\AppData\Local\resmon.resmoncfg
2014-07-26 22:30 - 2014-07-26 22:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Acer
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\CyberLink
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\PowerCinema
2014-07-26 22:28 - 2014-07-26 22:28 - 00000680 __RSH () C:\Users\Elisabeth_Franz\ntuser.pol
2014-07-26 22:27 - 2014-07-26 22:28 - 00000000 ____D () C:\Users\Elisabeth_Franz
2014-07-26 22:27 - 2014-07-26 22:27 - 00000020 ___SH () C:\Users\Elisabeth_Franz\ntuser.ini
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Vorlagen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Startmenü
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Netzwerkumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Lokale Einstellungen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Eigene Dateien
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Druckumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Musik
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Bilder
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Verlauf
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Anwendungsdaten
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Anwendungsdaten
2014-07-26 22:27 - 2014-02-17 15:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\Genie9
2014-07-26 22:27 - 2013-09-23 16:19 - 00000000 ____D () C:\Users\Elisabeth_Franz\Documents\Visual Studio 2010
2014-07-26 22:27 - 2011-11-16 10:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Microsoft Help
2014-07-26 22:27 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-26 22:27 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-26 13:51 - 2014-07-26 13:51 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-26 13:48 - 2014-07-26 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-07-25 12:16 - 2014-07-25 12:16 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-07-25 00:54 - 2014-07-25 00:54 - 00007120 ____N () C:\bootsqm.dat
2014-07-23 16:01 - 2014-07-23 16:12 - 00000000 ____D () C:\ProgramData\UcusIkcic
2014-07-14 15:04 - 2014-07-14 15:04 - 00000000 ____D () C:\Users\Christian\AppData\Local\G DATA
2014-07-11 20:13 - 2014-07-11 20:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\National Instruments
2014-07-11 19:48 - 2014-07-13 13:04 - 00000000 ____D () C:\Program Files\National Instruments
2014-07-11 19:40 - 2014-07-13 14:57 - 00000000 ____D () C:\Program Files (x86)\National Instruments
2014-07-11 19:38 - 2014-07-13 14:55 - 00000000 ____D () C:\ProgramData\National Instruments
2014-07-11 18:57 - 2014-07-29 15:14 - 00000000 ____D () C:\Users\Christian\Downloads\Programmierung
2014-07-10 20:11 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 20:11 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 20:11 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 20:11 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 20:10 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 20:10 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 20:09 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 20:09 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 20:09 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 20:09 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 20:09 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 20:09 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 20:09 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 20:09 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 20:09 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 20:09 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 20:09 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 20:09 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 20:09 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 20:09 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 20:09 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 20:09 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 20:09 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 20:09 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 20:09 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 20:09 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 20:09 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 20:09 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 20:09 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 20:09 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 20:09 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 20:09 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 20:09 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 20:09 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 20:09 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 20:09 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 20:09 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 20:09 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 20:09 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 20:09 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 20:09 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 20:09 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 20:09 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 20:09 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 20:09 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 20:09 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 20:09 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 20:09 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 20:09 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 20:09 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 20:09 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 20:09 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 20:09 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 20:09 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 20:09 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 20:09 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 20:09 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 20:09 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 20:09 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 20:09 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 20:09 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 20:09 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 20:08 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 20:08 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 20:08 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 10:57 - 2014-08-05 10:54 - 00017704 _____ () C:\Users\Christian\Desktop\FRST.txt
2014-08-05 10:56 - 2011-01-22 14:54 - 01627181 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 10:55 - 2014-08-05 10:53 - 00000000 ____D () C:\FRST
2014-08-05 10:51 - 2014-08-05 10:51 - 02094080 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2014-08-05 10:48 - 2014-05-18 11:50 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\CodeBlocks
2014-08-05 10:47 - 2012-04-01 13:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-05 10:47 - 2012-04-01 13:01 - 00003824 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-05 10:47 - 2012-04-01 13:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 10:47 - 2012-03-08 14:58 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-05 10:45 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:45 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 10:44 - 2011-01-22 23:41 - 00708520 _____ () C:\Windows\system32\perfh007.dat
2014-08-05 10:44 - 2011-01-22 23:41 - 00153568 _____ () C:\Windows\system32\perfc007.dat
2014-08-05 10:44 - 2009-07-14 07:13 - 01644736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 10:41 - 2011-06-05 01:18 - 00000000 ____D () C:\ProgramData\clear.fi
2014-08-05 10:36 - 2014-07-28 17:22 - 00001120 _____ () C:\Windows\setupact.log
2014-08-05 10:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-04 14:07 - 2013-05-16 18:01 - 00000000 ____D () C:\Users\Christian\AppData\Local\CrashDumps
2014-08-04 13:31 - 2011-12-14 15:47 - 00000000 ___RD () C:\Users\Christian\Desktop\Programme
2014-08-04 13:20 - 2014-08-04 13:19 - 00001069 _____ () C:\DelFix.txt
2014-08-04 13:19 - 2014-07-31 10:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 13:15 - 2014-07-29 17:43 - 00000000 ____D () C:\Windows\erdnt
2014-08-04 13:11 - 2013-11-11 18:05 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0752838C-B6C1-4564-9B69-B9E251C01A13}
2014-08-03 18:22 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\MediaPurge
2014-08-03 15:49 - 2014-07-28 17:21 - 00016320 _____ () C:\Windows\PFRO.log
2014-07-31 16:25 - 2013-03-21 18:46 - 00000000 ____D () C:\Program Files (x86)\NetServer
2014-07-31 16:22 - 2013-09-15 10:14 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\VisualAssist
2014-07-31 16:22 - 2013-09-15 10:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\VisualAssist
2014-07-31 16:21 - 2013-09-15 10:07 - 00000000 ____D () C:\Users\Christian\Documents\Atmel
2014-07-31 16:19 - 2011-10-31 18:53 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Diercke Globus
2014-07-31 16:10 - 2011-10-31 18:41 - 00000000 ____D () C:\Users\Christian\Documents\Diercke Globus Ansichten
2014-07-31 15:43 - 2011-06-04 21:45 - 00000000 ____D () C:\Users\Christian
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediapurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Program Files (x86)\Mediapurge
2014-07-31 13:58 - 2014-07-31 13:58 - 04040455 _____ () C:\Users\Christian\Downloads\Mediapurge556installer.exe
2014-07-31 13:58 - 2014-07-31 13:58 - 00000000 ____D () C:\Users\Christian\Downloads\Trojaner-Board
2014-07-30 22:17 - 2014-07-30 20:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 21:27 - 2014-06-01 15:43 - 00001196 _____ () C:\Users\Christian\Desktop\Ablage.txt
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-29 21:55 - 2014-07-28 17:33 - 00000680 __RSH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.pol
2014-07-29 21:55 - 2014-07-28 17:31 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC
2014-07-29 20:14 - 2011-07-15 18:00 - 00000000 ___RD () C:\Users\Christian\Desktop\Mein_Zimmer
2014-07-29 19:58 - 2014-04-23 15:42 - 00000000 ____D () C:\Users\dub_cm_auto
2014-07-29 19:58 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-07-29 19:41 - 2011-11-06 18:24 - 00000680 __RSH () C:\Users\Christian\ntuser.pol
2014-07-29 19:41 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-29 15:14 - 2014-07-11 18:57 - 00000000 ____D () C:\Users\Christian\Downloads\Programmierung
2014-07-29 11:13 - 2014-07-28 17:09 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-29 10:55 - 2014-07-29 10:56 - 00321448 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00191400 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00190888 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-07-29 10:55 - 2014-07-29 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-29 10:54 - 2014-07-29 10:54 - 00000000 ____D () C:\Program Files\Java
2014-07-29 10:46 - 2014-03-20 15:49 - 00014265 _____ () C:\Users\Christian\Desktop\Zeugnisse.xlsx
2014-07-29 10:40 - 2014-07-29 10:40 - 00000000 ____D () C:\Users\Christian\.structorizer
2014-07-28 17:41 - 2014-07-28 17:41 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Acer
2014-07-28 17:39 - 2014-07-28 17:38 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Games
2014-07-28 17:38 - 2014-07-28 17:38 - 00000622 _____ () C:\Users\Elisabeth & Franz.Christian-PC\Desktop\Solitär.lnk
2014-07-28 17:37 - 2014-07-28 17:37 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Duden
2014-07-28 17:36 - 2014-07-28 17:36 - 00166880 _____ () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Macromedia
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Adobe
2014-07-28 17:35 - 2014-07-28 17:35 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Google
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\CyberLink
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\PowerCinema
2014-07-28 17:31 - 2014-07-28 17:31 - 00000020 ___SH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.ini
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Vorlagen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Startmenü
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Netzwerkumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Lokale Einstellungen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Eigene Dateien
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Druckumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Musik
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Bilder
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Verlauf
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Anwendungsdaten
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Anwendungsdaten
2014-07-28 17:22 - 2014-07-28 17:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-28 17:15 - 2013-08-17 14:19 - 00000000 ____D () C:\Users\Christian\Documents\CCleaner_Registry
2014-07-28 17:09 - 2014-07-28 17:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-28 17:07 - 2014-07-28 17:07 - 04813544 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup416.exe
2014-07-28 16:59 - 2011-07-02 12:55 - 00000000 ___HD () C:\Program Files (x86)\InstallJammer Registry
2014-07-28 16:54 - 2011-07-02 13:03 - 00000000 ___RD () C:\Users\Christian\Desktop\Spiele
2014-07-28 15:30 - 2011-07-16 11:18 - 00000000 ____D () C:\ProgramData\Spreng- und Abriss-Simulator
2014-07-28 15:15 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-07-28 15:01 - 2010-12-02 10:24 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-07-28 14:56 - 2010-12-02 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-07-28 14:21 - 2010-12-02 10:13 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-07-28 13:56 - 2014-07-28 13:56 - 00000573 _____ () C:\Users\Christian\Desktop\Programmers Notepad [WinAVR].lnk
2014-07-28 13:06 - 2011-06-05 13:25 - 00000000 ___RD () C:\Users\Christian\Desktop\Sonstiges
2014-07-28 12:44 - 2014-07-28 12:44 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-07-28 12:44 - 2014-07-28 12:44 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-07-28 11:57 - 2014-07-28 11:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-28 11:45 - 2013-03-14 22:38 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-28 11:45 - 2013-03-14 22:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-27 18:26 - 2013-03-14 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-27 16:00 - 2014-07-27 15:54 - 251170997 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x64-RefreshPkg.msu
2014-07-27 15:50 - 2014-07-27 15:44 - 241162581 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x86-RefreshPkg.msu
2014-07-27 15:37 - 2011-06-04 21:45 - 00166880 _____ () C:\Users\Christian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-27 15:33 - 2012-04-05 12:06 - 00000000 ____D () C:\Program Files (x86)\K-3D 0.8.0.1
2014-07-27 15:14 - 2014-06-10 18:00 - 00000000 ____D () C:\Program Files (x86)\Drakensang - Am Fluss der Zeit
2014-07-27 15:14 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-27 15:13 - 2014-06-12 19:23 - 00000000 ____D () C:\Users\Christian\Documents\Drakensang_TRoT
2014-07-27 15:06 - 2009-07-14 06:45 - 00567864 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-27 15:02 - 2014-07-27 15:02 - 00003132 _____ () C:\Windows\System32\Tasks\{921BBC8D-8938-456B-B469-E310D9DA4059}
2014-07-27 14:24 - 2013-09-29 18:58 - 00000000 ____D () C:\Program Files (x86)\RapidSolution
2014-07-27 14:24 - 2011-12-10 16:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 9
2014-07-27 10:49 - 2014-07-27 10:46 - 05125829 _____ () C:\Users\Christian\Downloads\ccsetup416.zip
2014-07-27 09:51 - 2014-07-27 09:51 - 00000017 _____ () C:\Users\Christian\AppData\Local\resmon.resmoncfg
2014-07-27 09:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-27 09:47 - 2012-06-04 09:20 - 00000000 ____D () C:\Users\Christian\Documents\Outlook-Dateien
2014-07-26 22:30 - 2014-07-26 22:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Acer
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\CyberLink
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\PowerCinema
2014-07-26 22:28 - 2014-07-26 22:28 - 00000680 __RSH () C:\Users\Elisabeth_Franz\ntuser.pol
2014-07-26 22:28 - 2014-07-26 22:27 - 00000000 ____D () C:\Users\Elisabeth_Franz
2014-07-26 22:27 - 2014-07-26 22:27 - 00000020 ___SH () C:\Users\Elisabeth_Franz\ntuser.ini
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Vorlagen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Startmenü
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Netzwerkumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Lokale Einstellungen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Eigene Dateien
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Druckumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Musik
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Bilder
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Verlauf
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Anwendungsdaten
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Anwendungsdaten
2014-07-26 13:51 - 2014-07-26 13:51 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-26 13:50 - 2014-05-17 15:17 - 00000000 ____D () C:\ProgramData\G Data
2014-07-26 13:48 - 2014-07-26 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-07-26 13:41 - 2014-05-17 15:18 - 00000000 ____D () C:\Program Files (x86)\G Data
2014-07-26 13:35 - 2011-11-01 13:55 - 00000000 ____D () C:\Users\Elisabeth & Franz
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\com
2014-07-25 12:16 - 2014-07-25 12:16 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-07-25 03:22 - 2011-06-04 21:44 - 00000000 ____D () C:\Recovery
2014-07-25 00:54 - 2014-07-25 00:54 - 00007120 ____N () C:\bootsqm.dat
2014-07-24 17:29 - 2014-02-20 17:05 - 00000866 _____ () C:\Windows\system32\ServiceRunSettings.xml
2014-07-24 17:00 - 2009-07-14 06:45 - 00024576 _____ () C:\Windows\system32\umstartup.etl
2014-07-24 06:36 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-23 16:12 - 2014-07-23 16:01 - 00000000 ____D () C:\ProgramData\UcusIkcic
2014-07-16 20:40 - 2014-07-02 20:17 - 00000000 ____D () C:\Users\Christian\Documents\Steganos Safe
2014-07-15 19:12 - 2011-06-05 13:25 - 00000000 ___RD () C:\Users\Christian\Desktop\Französisch
2014-07-14 15:04 - 2014-07-14 15:04 - 00000000 ____D () C:\Users\Christian\AppData\Local\G DATA
2014-07-14 14:54 - 2014-03-20 15:48 - 00028368 _____ () C:\Users\Christian\Desktop\Noten.xlsx
2014-07-14 14:44 - 2012-05-23 16:42 - 00004282 _____ () C:\Users\Christian\AppData\Roaming\LTspiceIV.ini
2014-07-13 14:57 - 2014-07-11 19:40 - 00000000 ____D () C:\Program Files (x86)\National Instruments
2014-07-13 14:55 - 2014-07-11 19:38 - 00000000 ____D () C:\ProgramData\National Instruments
2014-07-13 13:06 - 2014-04-09 19:43 - 00000000 ____D () C:\Users\Christian\Desktop\Wirtschaft und Recht
2014-07-13 13:04 - 2014-07-11 19:48 - 00000000 ____D () C:\Program Files\National Instruments
2014-07-11 20:13 - 2014-07-11 20:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\National Instruments
2014-07-11 18:50 - 2013-07-18 14:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 18:36 - 2009-07-14 09:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 18:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 18:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-11 15:11 - 2011-06-04 21:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 14:54 - 2011-07-17 09:15 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-26 22:17

==================== End Of Log ============================
--- --- ---

schrauber 05.08.2014 18:14
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


sheldon299 05.08.2014 18:22
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-08-2014
Ran by Christian at 2014-08-05 19:22:31 Run:1
Running from C:\Users\Christian\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}

*****************

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled" => Could not move.
C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled => Moved successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} => Value not found.

==== End of Fixlog ====

schrauber 06.08.2014 15:15
Ordner weg beim Systemstart?

sheldon299 06.08.2014 17:38
Nein, und zusätzlich öffnet sich folgender leerer Ordner zweimal: "C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled"

schrauber 07.08.2014 16:35
Poste bitte nochmal ein frische FRST Log.

sheldon299 07.08.2014 18:46

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Christian (administrator) on CHRISTIAN-PC on 07-08-2014 19:37:02
Running from C:\Users\Christian\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Egis Technology Inc. ) C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Genie9) C:\Program Files\Genie9\Genie Timeline\GenieTimeLineAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Atmel) C:\Program Files (x86)\Atmel\Atmel Studio 6.0\atmelstudio.exe
(Atmel Corporation) C:\Program Files (x86)\Atmel\Atmel Studio 6.0\avrdbg\avrdbg.exe
(MCS Electronics) C:\Program Files (x86)\MCS Electronics\BASCOM-AVR\bascavr.exe
(Simon Tatham) C:\Users\Christian\Desktop\Mein_Zimmer\Bausatz_AVR-NET-IO\puttytel.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-624546122-312161334-520473447-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()
Startup: C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemExplorerDisabled ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - (No Name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {A3648F4B-44FD-4028-A44A-6A63C983B7FB} URL = https://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.11.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Christian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox
FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension
FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2011-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore

Chrome:
=======
CHR HomePage:
CHR NewTab: "chrome-extension://eooncjejnppfjjklapaamhcdmjbilmde/redirect.html",
                                "chrome-extension://amfclgbdpgndipgoegfpkkgobahigbcl/redirect.html"
CHR DefaultSearchKeyword: delta-search.com
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\gcswf32.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Christian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (YouTube) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-17]
CHR Extension: (Google-Suche) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-17]
CHR Extension: (Google Wallet) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Google Mail) - C:\Users\Christian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2010-11-18] (Advanced Micro Devices, Inc.) [File not signed]
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
R2 GenieTimelineService; C:\Program Files\Genie9\Genie Timeline\GenieTimelineService.exe [678464 2013-12-08] (Genie9)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [257344 2010-11-12] (NTI Corporation)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [807896 2012-05-21] (Mister Group)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2011-11-04] (www.winchiphead.com)
S3 DLPortIO; C:\Windows\SysWOW64\DRIVERS\DLPortIO.SYS [3584 2000-06-29] () [File not signed]
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-07-26] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-07-26] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-07-26] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-05-17] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-28] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-07-26] (G Data Software AG)
S2 hwpsgt; C:\Windows\SysWOW64\DRIVERS\hwpsgt.sys [137344 2011-07-13] () [File not signed]
S2 lemsgt; C:\Windows\SysWOW64\DRIVERS\lemsgt.sys [9472 2011-07-13] () [File not signed]
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2013-09-02] (hxxp://libusb-win32.sourceforge.net)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rsvcdwdr; C:\Windows\System32\DRIVERS\rsvcdwdr.sys [45160 2011-11-17] (RapidSolution Software AG)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2014-01-30] (Softwareentwicklung Remus - ArchiCrypt - )
S2 TVicPort; No ImagePath
R1 usedisk; C:\Windows\System32\DRIVERS\usedisk.sys [29208 2014-02-27] (Gili Soft INC.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-08-31] (Jungo)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Ser2pl; system32\DRIVERS\ser2pl64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 22:20 - 2014-08-06 22:20 - 00000000 _____ () C:\Windows\SysWOW64\sho5F23.tmp
2014-08-06 20:58 - 2014-08-06 20:58 - 00000000 __SHD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\EmieUserList
2014-08-06 20:58 - 2014-08-06 20:58 - 00000000 __SHD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\EmieSiteList
2014-08-06 19:34 - 2014-08-06 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-08-06 19:15 - 2014-08-06 19:15 - 00000000 ____D () C:\Users\Default\AppData\Local\Adobe
2014-08-06 19:15 - 2014-08-06 19:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\Adobe
2014-08-06 19:08 - 2014-08-06 19:05 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-06 19:07 - 2014-08-06 19:06 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 19:07 - 2014-08-06 19:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-06 19:07 - 2014-08-06 19:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-06 19:05 - 2014-08-06 19:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-05 22:30 - 2014-08-05 22:30 - 00000000 _____ () C:\Windows\SysWOW64\sho33B8.tmp
2014-08-05 20:45 - 2014-08-05 20:45 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\VirtualStore
2014-08-05 20:38 - 2014-08-05 20:38 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-08-05 20:38 - 2014-08-05 20:38 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-08-05 20:32 - 2014-08-06 20:29 - 00006832 _____ () C:\Windows\SecuniaPackage.log
2014-08-05 19:59 - 2014-08-05 19:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-08-05 19:54 - 2014-08-05 19:54 - 00001069 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-05 19:54 - 2014-08-05 19:54 - 00000000 ____D () C:\Users\Christian\AppData\Local\Secunia PSI
2014-08-05 19:54 - 2014-08-05 19:54 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-05 19:51 - 2014-08-05 19:52 - 05329480 _____ (Secunia) C:\Users\Christian\Downloads\PSISetup_3.0.0.9016.exe
2014-08-05 19:13 - 2014-08-05 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
2014-08-05 19:13 - 2014-08-05 19:13 - 00000000 ____D () C:\Program Files (x86)\Free M4a to MP3 Converter
2014-08-05 18:42 - 2014-08-05 18:42 - 06424632 _____ (ManiacTools.com ) C:\Users\Christian\Downloads\m4a-to-mp3-81converter.exe
2014-08-05 11:36 - 2014-08-05 11:36 - 01110476 _____ () C:\Users\Christian\Downloads\7z920.exe
2014-08-05 11:36 - 2014-08-05 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-08-05 11:36 - 2014-08-05 11:36 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-08-05 11:05 - 2014-08-05 11:08 - 00068585 _____ () C:\Users\Christian\Desktop\Addition.txt
2014-08-05 10:54 - 2014-08-07 19:39 - 00017991 _____ () C:\Users\Christian\Desktop\FRST.txt
2014-08-05 10:53 - 2014-08-07 19:37 - 00000000 ____D () C:\FRST
2014-08-05 10:51 - 2014-08-05 10:51 - 02094080 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2014-08-04 13:19 - 2014-08-04 13:20 - 00001069 _____ () C:\DelFix.txt
2014-07-31 13:59 - 2014-08-03 18:22 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\MediaPurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediapurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Program Files (x86)\Mediapurge
2014-07-31 13:58 - 2014-07-31 13:58 - 04040455 _____ () C:\Users\Christian\Downloads\Mediapurge556installer.exe
2014-07-31 13:58 - 2014-07-31 13:58 - 00000000 ____D () C:\Users\Christian\Downloads\Trojaner-Board
2014-07-31 10:05 - 2014-08-04 13:19 - 00000000 ____D () C:\Windows\ERUNT
2014-07-31 09:39 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-30 20:33 - 2014-08-05 19:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 20:32 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 20:32 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-29 17:43 - 2014-08-04 13:15 - 00000000 ____D () C:\Windows\erdnt
2014-07-29 10:56 - 2014-07-29 10:55 - 00321448 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-29 10:55 - 2014-08-06 19:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-29 10:55 - 2014-07-29 10:55 - 00191400 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00190888 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-07-29 10:54 - 2014-07-29 10:54 - 00000000 ____D () C:\Program Files\Java
2014-07-29 10:40 - 2014-07-29 10:40 - 00000000 ____D () C:\Users\Christian\.structorizer
2014-07-28 17:41 - 2014-07-28 17:41 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Acer
2014-07-28 17:38 - 2014-07-28 17:39 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Games
2014-07-28 17:38 - 2014-07-28 17:38 - 00000622 _____ () C:\Users\Elisabeth & Franz.Christian-PC\Desktop\Solitär.lnk
2014-07-28 17:37 - 2014-07-28 17:37 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Duden
2014-07-28 17:36 - 2014-07-28 17:36 - 00166880 _____ () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Macromedia
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Adobe
2014-07-28 17:35 - 2014-07-28 17:35 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Google
2014-07-28 17:33 - 2014-07-29 21:55 - 00000680 __RSH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.pol
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\CyberLink
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\PowerCinema
2014-07-28 17:31 - 2014-07-29 21:55 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC
2014-07-28 17:31 - 2014-07-28 17:31 - 00000020 ___SH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.ini
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Vorlagen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Startmenü
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Netzwerkumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Lokale Einstellungen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Eigene Dateien
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Druckumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Musik
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Bilder
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Verlauf
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Anwendungsdaten
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Anwendungsdaten
2014-07-28 17:31 - 2014-02-17 15:30 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Genie9
2014-07-28 17:31 - 2013-09-23 16:19 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Visual Studio 2010
2014-07-28 17:31 - 2011-11-16 10:30 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Help
2014-07-28 17:31 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-28 17:31 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-28 17:22 - 2014-08-07 19:36 - 00001490 _____ () C:\Windows\setupact.log
2014-07-28 17:22 - 2014-07-28 17:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-28 17:21 - 2014-08-07 16:41 - 00016932 _____ () C:\Windows\PFRO.log
2014-07-28 17:09 - 2014-07-29 11:13 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-28 17:09 - 2014-07-28 17:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-28 17:07 - 2014-07-28 17:07 - 04813544 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup416.exe
2014-07-28 13:56 - 2014-07-28 13:56 - 00000573 _____ () C:\Users\Christian\Desktop\Programmers Notepad [WinAVR].lnk
2014-07-28 12:44 - 2014-07-28 12:44 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-07-28 12:44 - 2014-07-28 12:44 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-07-28 11:57 - 2014-08-05 18:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-27 15:54 - 2014-07-27 16:00 - 251170997 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x64-RefreshPkg.msu
2014-07-27 15:44 - 2014-07-27 15:50 - 241162581 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x86-RefreshPkg.msu
2014-07-27 15:02 - 2014-07-27 15:02 - 00003132 _____ () C:\Windows\System32\Tasks\{921BBC8D-8938-456B-B469-E310D9DA4059}
2014-07-27 10:46 - 2014-07-27 10:49 - 05125829 _____ () C:\Users\Christian\Downloads\ccsetup416.zip
2014-07-27 09:51 - 2014-07-27 09:51 - 00000017 _____ () C:\Users\Christian\AppData\Local\resmon.resmoncfg
2014-07-26 22:30 - 2014-07-26 22:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Acer
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\CyberLink
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\PowerCinema
2014-07-26 22:28 - 2014-07-26 22:28 - 00000680 __RSH () C:\Users\Elisabeth_Franz\ntuser.pol
2014-07-26 22:27 - 2014-07-26 22:28 - 00000000 ____D () C:\Users\Elisabeth_Franz
2014-07-26 22:27 - 2014-07-26 22:27 - 00000020 ___SH () C:\Users\Elisabeth_Franz\ntuser.ini
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Vorlagen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Startmenü
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Netzwerkumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Lokale Einstellungen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Eigene Dateien
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Druckumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Musik
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Bilder
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Verlauf
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Anwendungsdaten
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Anwendungsdaten
2014-07-26 22:27 - 2014-02-17 15:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\Genie9
2014-07-26 22:27 - 2013-09-23 16:19 - 00000000 ____D () C:\Users\Elisabeth_Franz\Documents\Visual Studio 2010
2014-07-26 22:27 - 2011-11-16 10:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Microsoft Help
2014-07-26 22:27 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-26 22:27 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-26 13:51 - 2014-07-26 13:51 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-26 13:48 - 2014-07-26 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-07-25 12:16 - 2014-07-25 12:16 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-07-25 00:54 - 2014-07-25 00:54 - 00007120 ____N () C:\bootsqm.dat
2014-07-23 16:01 - 2014-07-23 16:12 - 00000000 ____D () C:\ProgramData\UcusIkcic
2014-07-14 15:04 - 2014-07-14 15:04 - 00000000 ____D () C:\Users\Christian\AppData\Local\G DATA
2014-07-11 20:13 - 2014-07-11 20:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\National Instruments
2014-07-11 19:48 - 2014-07-13 13:04 - 00000000 ____D () C:\Program Files\National Instruments
2014-07-11 19:40 - 2014-07-13 14:57 - 00000000 ____D () C:\Program Files (x86)\National Instruments
2014-07-11 19:38 - 2014-07-13 14:55 - 00000000 ____D () C:\ProgramData\National Instruments
2014-07-11 18:57 - 2014-08-07 18:26 - 00000000 ____D () C:\Users\Christian\Downloads\Programmierung
2014-07-10 20:11 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 20:11 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 20:11 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 20:11 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 20:10 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 20:10 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-10 20:10 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-10 20:10 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-10 20:09 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 20:09 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 20:09 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 20:09 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 20:09 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-10 20:09 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 20:09 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 20:09 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-10 20:09 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-10 20:09 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-10 20:09 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 20:09 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-10 20:09 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 20:09 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 20:09 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-10 20:09 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-10 20:09 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 20:09 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-10 20:09 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 20:09 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-10 20:09 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 20:09 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-10 20:09 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 20:09 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 20:09 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 20:09 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 20:09 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 20:09 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-10 20:09 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-10 20:09 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-10 20:09 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 20:09 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 20:09 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 20:09 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-10 20:09 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 20:09 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-10 20:09 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 20:09 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 20:09 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-10 20:09 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 20:09 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-10 20:09 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-10 20:09 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 20:09 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 20:09 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 20:09 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 20:09 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 20:09 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 20:09 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-10 20:09 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 20:09 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 20:09 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 20:09 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 20:09 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 20:09 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 20:09 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 20:08 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 20:08 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-10 20:08 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 19:39 - 2014-08-05 10:54 - 00017991 _____ () C:\Users\Christian\Desktop\FRST.txt
2014-08-07 19:39 - 2011-01-22 23:41 - 00708520 _____ () C:\Windows\system32\perfh007.dat
2014-08-07 19:39 - 2011-01-22 23:41 - 00153568 _____ () C:\Windows\system32\perfc007.dat
2014-08-07 19:39 - 2009-07-14 07:13 - 01644736 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-07 19:37 - 2014-08-05 10:53 - 00000000 ____D () C:\FRST
2014-08-07 19:36 - 2014-07-28 17:22 - 00001490 _____ () C:\Windows\setupact.log
2014-08-07 18:26 - 2014-07-11 18:57 - 00000000 ____D () C:\Users\Christian\Downloads\Programmierung
2014-08-07 17:25 - 2010-12-02 10:41 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-08-07 17:05 - 2013-09-15 10:14 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\VisualAssist
2014-08-07 17:04 - 2013-09-15 10:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\VisualAssist
2014-08-07 17:03 - 2013-09-15 10:07 - 00000000 ____D () C:\Users\Christian\Documents\Atmel
2014-08-07 16:59 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-07 16:59 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-07 16:55 - 2011-01-22 14:54 - 01909394 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 16:52 - 2013-11-11 18:05 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0752838C-B6C1-4564-9B69-B9E251C01A13}
2014-08-07 16:48 - 2011-06-05 01:18 - 00000000 ____D () C:\ProgramData\clear.fi
2014-08-07 16:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-07 16:41 - 2014-07-28 17:21 - 00016932 _____ () C:\Windows\PFRO.log
2014-08-06 22:20 - 2014-08-06 22:20 - 00000000 _____ () C:\Windows\SysWOW64\sho5F23.tmp
2014-08-06 20:58 - 2014-08-06 20:58 - 00000000 __SHD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\EmieUserList
2014-08-06 20:58 - 2014-08-06 20:58 - 00000000 __SHD () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\EmieSiteList
2014-08-06 20:30 - 2010-12-02 10:42 - 00000000 ____D () C:\ProgramData\Adobe
2014-08-06 20:29 - 2014-08-05 20:32 - 00006832 _____ () C:\Windows\SecuniaPackage.log
2014-08-06 19:51 - 2014-08-06 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-08-06 19:34 - 2014-01-27 15:52 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
2014-08-06 19:32 - 2011-07-07 15:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-06 19:15 - 2014-08-06 19:15 - 00000000 ____D () C:\Users\Default\AppData\Local\Adobe
2014-08-06 19:15 - 2014-08-06 19:15 - 00000000 ____D () C:\Users\Default User\AppData\Local\Adobe
2014-08-06 19:07 - 2014-07-29 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 19:06 - 2014-08-06 19:07 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-06 19:05 - 2014-08-06 19:08 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-06 19:05 - 2014-08-06 19:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-06 19:05 - 2014-08-06 19:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-06 19:05 - 2014-08-06 19:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-05 22:30 - 2014-08-05 22:30 - 00000000 _____ () C:\Windows\SysWOW64\sho33B8.tmp
2014-08-05 20:45 - 2014-08-05 20:45 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\VirtualStore
2014-08-05 20:38 - 2014-08-05 20:38 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-08-05 20:38 - 2014-08-05 20:38 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-08-05 19:59 - 2014-08-05 19:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-08-05 19:59 - 2014-07-30 20:33 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:54 - 2014-08-05 19:54 - 00001069 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-08-05 19:54 - 2014-08-05 19:54 - 00000000 ____D () C:\Users\Christian\AppData\Local\Secunia PSI
2014-08-05 19:54 - 2014-08-05 19:54 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-08-05 19:52 - 2014-08-05 19:51 - 05329480 _____ (Secunia) C:\Users\Christian\Downloads\PSISetup_3.0.0.9016.exe
2014-08-05 19:47 - 2011-12-14 15:47 - 00000000 ___RD () C:\Users\Christian\Desktop\Programme
2014-08-05 19:13 - 2014-08-05 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
2014-08-05 19:13 - 2014-08-05 19:13 - 00000000 ____D () C:\Program Files (x86)\Free M4a to MP3 Converter
2014-08-05 18:57 - 2014-07-28 11:57 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-05 18:42 - 2014-08-05 18:42 - 06424632 _____ (ManiacTools.com ) C:\Users\Christian\Downloads\m4a-to-mp3-81converter.exe
2014-08-05 15:20 - 2014-05-18 11:50 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\CodeBlocks
2014-08-05 11:41 - 2012-04-01 13:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 11:36 - 2014-08-05 11:36 - 01110476 _____ () C:\Users\Christian\Downloads\7z920.exe
2014-08-05 11:36 - 2014-08-05 11:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-08-05 11:36 - 2014-08-05 11:36 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-08-05 11:08 - 2014-08-05 11:05 - 00068585 _____ () C:\Users\Christian\Desktop\Addition.txt
2014-08-05 10:51 - 2014-08-05 10:51 - 02094080 _____ (Farbar) C:\Users\Christian\Desktop\FRST64.exe
2014-08-05 10:47 - 2012-04-01 13:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-05 10:47 - 2012-04-01 13:01 - 00003824 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-05 10:47 - 2012-03-08 14:58 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-04 14:07 - 2013-05-16 18:01 - 00000000 ____D () C:\Users\Christian\AppData\Local\CrashDumps
2014-08-04 13:20 - 2014-08-04 13:19 - 00001069 _____ () C:\DelFix.txt
2014-08-04 13:19 - 2014-07-31 10:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 13:15 - 2014-07-29 17:43 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 18:22 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\MediaPurge
2014-07-31 16:25 - 2013-03-21 18:46 - 00000000 ____D () C:\Program Files (x86)\NetServer
2014-07-31 16:19 - 2011-10-31 18:53 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Diercke Globus
2014-07-31 16:10 - 2011-10-31 18:41 - 00000000 ____D () C:\Users\Christian\Documents\Diercke Globus Ansichten
2014-07-31 15:43 - 2011-06-04 21:45 - 00000000 ____D () C:\Users\Christian
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediapurge
2014-07-31 13:59 - 2014-07-31 13:59 - 00000000 ____D () C:\Program Files (x86)\Mediapurge
2014-07-31 13:58 - 2014-07-31 13:58 - 04040455 _____ () C:\Users\Christian\Downloads\Mediapurge556installer.exe
2014-07-31 13:58 - 2014-07-31 13:58 - 00000000 ____D () C:\Users\Christian\Downloads\Trojaner-Board
2014-07-30 21:27 - 2014-06-01 15:43 - 00001196 _____ () C:\Users\Christian\Desktop\Ablage.txt
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 20:32 - 2014-07-30 20:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-29 21:55 - 2014-07-28 17:33 - 00000680 __RSH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.pol
2014-07-29 21:55 - 2014-07-28 17:31 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC
2014-07-29 20:14 - 2011-07-15 18:00 - 00000000 ___RD () C:\Users\Christian\Desktop\Mein_Zimmer
2014-07-29 19:58 - 2014-04-23 15:42 - 00000000 ____D () C:\Users\dub_cm_auto
2014-07-29 19:58 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-07-29 19:41 - 2011-11-06 18:24 - 00000680 __RSH () C:\Users\Christian\ntuser.pol
2014-07-29 19:41 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-29 11:13 - 2014-07-28 17:09 - 00002782 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-29 10:55 - 2014-07-29 10:56 - 00321448 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00191400 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00190888 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-29 10:55 - 2014-07-29 10:55 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-07-29 10:54 - 2014-07-29 10:54 - 00000000 ____D () C:\Program Files\Java
2014-07-29 10:46 - 2014-03-20 15:49 - 00014265 _____ () C:\Users\Christian\Desktop\Zeugnisse.xlsx
2014-07-29 10:40 - 2014-07-29 10:40 - 00000000 ____D () C:\Users\Christian\.structorizer
2014-07-28 17:41 - 2014-07-28 17:41 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Acer
2014-07-28 17:39 - 2014-07-28 17:38 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Microsoft Games
2014-07-28 17:38 - 2014-07-28 17:38 - 00000622 _____ () C:\Users\Elisabeth & Franz.Christian-PC\Desktop\Solitär.lnk
2014-07-28 17:37 - 2014-07-28 17:37 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Duden
2014-07-28 17:36 - 2014-07-28 17:36 - 00166880 _____ () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Macromedia
2014-07-28 17:36 - 2014-07-28 17:36 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Adobe
2014-07-28 17:35 - 2014-07-28 17:35 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Google
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\CyberLink
2014-07-28 17:33 - 2014-07-28 17:33 - 00000000 ____D () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\PowerCinema
2014-07-28 17:31 - 2014-07-28 17:31 - 00000020 ___SH () C:\Users\Elisabeth & Franz.Christian-PC\ntuser.ini
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Vorlagen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Startmenü
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Netzwerkumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Lokale Einstellungen
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Eigene Dateien
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Druckumgebung
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Musik
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Documents\Eigene Bilder
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Verlauf
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\AppData\Local\Anwendungsdaten
2014-07-28 17:31 - 2014-07-28 17:31 - 00000000 _SHDL () C:\Users\Elisabeth & Franz.Christian-PC\Anwendungsdaten
2014-07-28 17:22 - 2014-07-28 17:22 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-28 17:15 - 2013-08-17 14:19 - 00000000 ____D () C:\Users\Christian\Documents\CCleaner_Registry
2014-07-28 17:09 - 2014-07-28 17:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-28 17:07 - 2014-07-28 17:07 - 04813544 _____ (Piriform Ltd) C:\Users\Christian\Downloads\ccsetup416.exe
2014-07-28 16:59 - 2011-07-02 12:55 - 00000000 ___HD () C:\Program Files (x86)\InstallJammer Registry
2014-07-28 16:54 - 2011-07-02 13:03 - 00000000 ___RD () C:\Users\Christian\Desktop\Spiele
2014-07-28 15:30 - 2011-07-16 11:18 - 00000000 ____D () C:\ProgramData\Spreng- und Abriss-Simulator
2014-07-28 15:15 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-07-28 15:01 - 2010-12-02 10:24 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-07-28 14:56 - 2010-12-02 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-07-28 14:21 - 2010-12-02 10:13 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-07-28 13:56 - 2014-07-28 13:56 - 00000573 _____ () C:\Users\Christian\Desktop\Programmers Notepad [WinAVR].lnk
2014-07-28 13:06 - 2011-06-05 13:25 - 00000000 ___RD () C:\Users\Christian\Desktop\Sonstiges
2014-07-28 12:44 - 2014-07-28 12:44 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2014-07-28 12:44 - 2014-07-28 12:44 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2014-07-28 11:45 - 2013-03-14 22:38 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-28 11:45 - 2013-03-14 22:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-27 18:26 - 2013-03-14 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-27 16:00 - 2014-07-27 15:54 - 251170997 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x64-RefreshPkg.msu
2014-07-27 15:50 - 2014-07-27 15:44 - 241162581 _____ () C:\Users\Christian\Downloads\Windows6.1-KB958830-x86-RefreshPkg.msu
2014-07-27 15:37 - 2011-06-04 21:45 - 00166880 _____ () C:\Users\Christian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-27 15:33 - 2012-04-05 12:06 - 00000000 ____D () C:\Program Files (x86)\K-3D 0.8.0.1
2014-07-27 15:14 - 2014-06-10 18:00 - 00000000 ____D () C:\Program Files (x86)\Drakensang - Am Fluss der Zeit
2014-07-27 15:14 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-07-27 15:13 - 2014-06-12 19:23 - 00000000 ____D () C:\Users\Christian\Documents\Drakensang_TRoT
2014-07-27 15:06 - 2009-07-14 06:45 - 00567864 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-27 15:02 - 2014-07-27 15:02 - 00003132 _____ () C:\Windows\System32\Tasks\{921BBC8D-8938-456B-B469-E310D9DA4059}
2014-07-27 14:24 - 2013-09-29 18:58 - 00000000 ____D () C:\Program Files (x86)\RapidSolution
2014-07-27 14:24 - 2011-12-10 16:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audials 9
2014-07-27 10:49 - 2014-07-27 10:46 - 05125829 _____ () C:\Users\Christian\Downloads\ccsetup416.zip
2014-07-27 09:51 - 2014-07-27 09:51 - 00000017 _____ () C:\Users\Christian\AppData\Local\resmon.resmoncfg
2014-07-27 09:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-07-27 09:47 - 2012-06-04 09:20 - 00000000 ____D () C:\Users\Christian\Documents\Outlook-Dateien
2014-07-26 22:30 - 2014-07-26 22:30 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\Acer
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Roaming\CyberLink
2014-07-26 22:29 - 2014-07-26 22:29 - 00000000 ____D () C:\Users\Elisabeth_Franz\AppData\Local\PowerCinema
2014-07-26 22:28 - 2014-07-26 22:28 - 00000680 __RSH () C:\Users\Elisabeth_Franz\ntuser.pol
2014-07-26 22:28 - 2014-07-26 22:27 - 00000000 ____D () C:\Users\Elisabeth_Franz
2014-07-26 22:27 - 2014-07-26 22:27 - 00000020 ___SH () C:\Users\Elisabeth_Franz\ntuser.ini
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Vorlagen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Startmenü
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Netzwerkumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Lokale Einstellungen
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Eigene Dateien
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Druckumgebung
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Musik
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Documents\Eigene Bilder
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Verlauf
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\AppData\Local\Anwendungsdaten
2014-07-26 22:27 - 2014-07-26 22:27 - 00000000 _SHDL () C:\Users\Elisabeth_Franz\Anwendungsdaten
2014-07-26 13:51 - 2014-07-26 13:51 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-26 13:51 - 2014-07-26 13:51 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-26 13:50 - 2014-05-17 15:17 - 00000000 ____D () C:\ProgramData\G Data
2014-07-26 13:48 - 2014-07-26 13:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-07-26 13:41 - 2014-05-17 15:18 - 00000000 ____D () C:\Program Files (x86)\G Data
2014-07-26 13:35 - 2011-11-01 13:55 - 00000000 ____D () C:\Users\Elisabeth & Franz
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-07-26 13:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\com
2014-07-25 12:16 - 2014-07-25 12:16 - 00000017 _____ () C:\Windows\SysWOW64\shortcut_ex.dat
2014-07-25 03:22 - 2011-06-04 21:44 - 00000000 ____D () C:\Recovery
2014-07-25 00:54 - 2014-07-25 00:54 - 00007120 ____N () C:\bootsqm.dat
2014-07-24 17:29 - 2014-02-20 17:05 - 00000866 _____ () C:\Windows\system32\ServiceRunSettings.xml
2014-07-24 17:00 - 2009-07-14 06:45 - 00024576 _____ () C:\Windows\system32\umstartup.etl
2014-07-24 06:36 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-23 16:12 - 2014-07-23 16:01 - 00000000 ____D () C:\ProgramData\UcusIkcic
2014-07-16 20:40 - 2014-07-02 20:17 - 00000000 ____D () C:\Users\Christian\Documents\Steganos Safe
2014-07-15 19:12 - 2011-06-05 13:25 - 00000000 ___RD () C:\Users\Christian\Desktop\Französisch
2014-07-14 15:04 - 2014-07-14 15:04 - 00000000 ____D () C:\Users\Christian\AppData\Local\G DATA
2014-07-14 14:54 - 2014-03-20 15:48 - 00028368 _____ () C:\Users\Christian\Desktop\Noten.xlsx
2014-07-14 14:44 - 2012-05-23 16:42 - 00004282 _____ () C:\Users\Christian\AppData\Roaming\LTspiceIV.ini
2014-07-13 14:57 - 2014-07-11 19:40 - 00000000 ____D () C:\Program Files (x86)\National Instruments
2014-07-13 14:55 - 2014-07-11 19:38 - 00000000 ____D () C:\ProgramData\National Instruments
2014-07-13 13:06 - 2014-04-09 19:43 - 00000000 ____D () C:\Users\Christian\Desktop\Wirtschaft und Recht
2014-07-13 13:04 - 2014-07-11 19:48 - 00000000 ____D () C:\Program Files\National Instruments
2014-07-11 20:13 - 2014-07-11 20:13 - 00000000 ____D () C:\Users\Christian\AppData\Local\National Instruments
2014-07-11 18:50 - 2013-07-18 14:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 18:36 - 2009-07-14 09:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 18:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-11 18:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-11 15:11 - 2011-06-04 21:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 14:54 - 2011-07-17 09:15 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Christian\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-26 22:17

==================== End Of Log ============================
--- --- ---

schrauber 08.08.2014 16:19
Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)
  • Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:
    :regfind
    SystemExplorerDisabled
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

sheldon299 09.08.2014 09:54
Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 10:35 on 09/08/2014 by Christian
Administrator - Elevation successful

========== regfind ==========

Searching for "SystemExplorerDisabled"
No data found.

-= EOF =-

schrauber 09.08.2014 17:42
Öffne mal bitte FRST, setz nen Haken bei Addition und scanne, poste bitte beide Logfiles.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:36 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19