Trojaner-Board - Windows 8; Security Alert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 8; Security Alert (https://www.trojaner-board.de/159779-windows-8-security-alert.html)

Windows 8; Security Alert

Guten Abend,

ich vermute, ich habe mir beim Surfen mit FF eine Bedrohung eingefangen.

Nach einiger Zeit erscheint ein Warnfester "Security Alert" mit der Meldung " Potential threat details" auf meinem Bildschirm (siehe Anlage). Diese Software benutze ich nicht und das Fenster lässt sich auch nicht so einfach schließen.

Der Einsatz Malwarebytes Anti-Malware führte nicht zum Erfolg.

Ist dieses nach euer Erfahrung ein Schädling und wie bekomme ich selbigen von meinem Rechner?

Danke für die Hilfe.

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Guten Morgen,

hier die Logs:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-10-2014 02

Ran by ***** at 2014-10-15 22:39:00

Running from C:\Users\*****\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Creo Thumbnail Viewer 2.0 (HKLM\...\{3F8CCE46-EAFD-4283-9ADB-7025EAC2CF64}) (Version: 30.12.480 - PTC)

Designer 2.0 (HKLM-x32\...\Designer 2.0_is1) (Version: 7.9.6 - Fomanu AG)

EPSON BX525WD Series Printer Uninstall (HKLM\...\EPSON BX525WD Series) (Version:  - SEIKO EPSON Corporation)

ETDWare PS/2-X64 11.6.22.201_WHQL (HKLM\...\Elantech) (Version: 11.6.22.201 - ELAN Microelectronic Corp.)

iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)

Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

MKS Platform Components 9.x (HKLM\...\{30023972-0000-0903-9ABB-000BDB5CF35D}) (Version: 9.3.0000 - Mortice Kern Systems)

Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)

NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden

NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDF-XChange Editor (HKLM-x32\...\{87738bc6-bdf0-4e55-86b5-32ddece8f51d}) (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.)

PDF-XChange Editor (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.) Hidden

Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.)

Samsung Kies3 (x32 Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.) Hidden

SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden

VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)

WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

28-09-2014 10:14:08 Windows Modules Installer

12-10-2014 11:45:06 Windows Update

15-10-2014 14:00:54 Removed Optimum PC Boost
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {1ECBF38A-C1F9-4547-8C0E-5695D37BB6C4} - \FoxTab No Task File <==== ATTENTION

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {24CEFABA-9030-40FB-BFAA-9E04940F6B71} - System32\Tasks\Optimum_LogOn => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {34F2800C-218C-4493-B520-02E7D528467D} - System32\Tasks\Secure Fast PC Auto Updater => C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe [2014-10-02] ()

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {54563E16-A00B-4B48-A263-DB6B9422D70C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {6388F555-9135-46AF-9F1B-4BAFB6FB0C91} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-10-15] ()

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {6E8769E4-B628-47C0-B468-F349793D9594} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {75DB2D10-5C76-483B-98F9-DB654B2A08EB} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {7EBDCA38-F63D-4DF7-B6B8-D6182402285D} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {8677F14A-FF43-4CE0-9EA7-F73DEDD3B8AA} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {93389A9A-DE2D-41E8-BD68-ABACF0A06316} - \Digital Sites No Task File <==== ATTENTION

Task: {9B5D8BD6-5619-4E34-ABC9-6456A17CC707} - System32\Tasks\Optimum_Daily => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {9DB07B69-CE48-436F-BE9A-FD809EFBA494} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {9EAF8CB8-1FC6-4C8F-8D66-7E95E4BC0BF2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {B5805C99-52AB-4A13-8DF8-98CB3574508A} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {B8EEEEDB-BEC3-48D3-8AB1-3E75E328D19C} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {C0017E72-34E6-454E-BD30-C4974CD6B77A} - System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {E7B7DC04-38BC-4B75-81FE-F23C12A2E2E6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-19] (AVAST Software)

Task: {EF3F3EE7-C823-4AB9-A716-0BDA67B410DD} - System32\Tasks\Secure Fast PC Autorun => C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe

Task: {FEC944E4-4B72-4175-B1DB-9C72EEF41725} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
 

==================== Loaded Modules (whitelisted) =============
 

2014-09-12 21:40 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-04-09 21:33 - 2014-07-02 10:13 - 01427736 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2014-10-02 13:24 - 2014-10-02 13:32 - 00187904 _____ () C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe

2012-10-01 21:36 - 2012-10-01 21:36 - 01408624 _____ () C:\Program Files\Microsoft Office\Office15\ADDINS\UmOutlookAddin.dll

2014-10-15 14:42 - 2014-10-15 14:42 - 02874368 _____ () C:\Program Files\AVAST Software\Avast\defs\14101500\algo.dll

2014-10-15 22:05 - 2014-10-15 22:05 - 02874368 _____ () C:\Program Files\AVAST Software\Avast\defs\14101506\algo.dll

2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 09789208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll

2014-04-09 21:32 - 2014-07-02 10:14 - 03880216 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00035608 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00322840 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00309016 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02738456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 01043456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00250368 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00136472 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02116376 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01932568 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00094720 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 04326168 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01564952 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 05291288 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01698584 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01809688 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01627928 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01117976 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01341208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01309464 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 07340824 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01286936 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01331480 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll

2014-04-12 13:48 - 2014-04-12 13:48 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-09-26 22:39 - 2014-09-26 22:39 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\*****\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

HKLM\...\StartupApproved\Run: => "HotKeysCmds"

HKLM\...\StartupApproved\Run: => "IgfxTray"

HKLM\...\StartupApproved\Run: => "Persistence"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-835766522-2148508782-3467690004-500 - Administrator - Disabled)

Gast (S-1-5-21-835766522-2148508782-3467690004-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-835766522-2148508782-3467690004-1003 - Limited - Enabled)

***** (S-1-5-21-835766522-2148508782-3467690004-1001 - Administrator - Enabled) => C:\Users\*****
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/15/2014 03:21:30 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 03:14:44 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:14:07 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:01:51 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:00:59 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:00:08 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 02:43:03 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 02:42:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 00:43:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

hr=0xC004F074

Befehlszeilenargumente:

RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 11:07:53 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073418225
 
 

System errors:

=============

Error: (10/15/2014 10:04:24 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)

Description: A TCG Command has returned an error.

Desc: AuthenticateSession

Param1: 0x1

Param2: 0x60000001c

Param3: 0x900000006

Param4: 0x0

Status: 0x1
 

Error: (10/15/2014 08:46:24 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/15/2014 06:33:52 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)

Description: A TCG Command has returned an error.

Desc: AuthenticateSession

Param1: 0x1

Param2: 0x60000001c

Param3: 0x900000006

Param4: 0x0

Status: 0x1
 

Error: (10/15/2014 06:33:35 PM) (Source: DCOM) (EventID: 10010) (User: *****_LAPTOP)

Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
 

Error: (10/15/2014 06:33:10 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/15/2014 02:59:12 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/15/2014 00:42:13 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/14/2014 08:48:42 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/14/2014 06:06:41 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/14/2014 06:04:25 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 
 

Microsoft Office Sessions:

=========================

Error: (10/15/2014 03:21:30 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 03:14:44 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:14:07 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:01:51 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:00:59 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 03:00:08 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 02:43:03 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 02:42:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=TimerEvent
 

Error: (10/15/2014 00:43:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )

Description: hr=0xC004F074RuleId=dca14e37-0c5c-444f-9b35-1e2f161f5ac3;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c06b6981-d7fd-4a35-b7b4-054742b7af67;NotificationInterval=1440;Trigger=NetworkAvailable
 

Error: (10/15/2014 11:07:53 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073418225
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-19 22:49:34.167

  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz

Percentage of memory in use: 22%

Total physical RAM: 8076.36 MB

Available physical RAM: 6292.54 MB

Total Pagefile: 9356.36 MB

Available Pagefile: 7414.82 MB

Total Virtual: 131072 MB

Available Virtual: 131071.79 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:111.79 GB) (Free:43.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Volume) (Fixed) (Total:465.67 GB) (Free:380.82 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 285EB630)

Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 02

Ran by ***** (administrator) on *****_LAPTOP on 15-10-2014 22:38:33

Running from C:\Users\*****\Downloads

Loaded Profile: ***** (Available profiles: *****)

Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Atheros Commnucations) C:\Windows\System32\AdminService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

(MKS Software Inc.) C:\Windows\System32\nutsrv4.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(PTC) C:\Program Files\PTC\PTC Portmapper\i486_nt\obj\portmap.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE

() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

() C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\livecomm.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-10] (ELAN Microelectronics Corp.)

HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [NuTCSetupEnviron] => C:\Program Files\PTC\MKS Toolkit\bin\ncoeenv.exe [37160 2009-11-23] (MKS Software Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-15] (AVAST Software)

HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-835766522-2148508782-3467690004-1001\...\Run: [EPSON BX525WD Series (Kopie 1)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/software/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Winsock: Catalog9 12 C:\Windows\SysWOW64\nutafun4.dll [164144] (MKS Software Inc.)

Winsock: Catalog9 13 C:\Windows\SysWOW64\nutafun4.dll [164144] (MKS Software Inc.)

Winsock: Catalog9-x64 12 %SystemRoot%\system32\nutafun4.dll [205024] (MKS Software Inc.)

Winsock: Catalog9-x64 13 %SystemRoot%\system32\nutafun4.dll [205024] (MKS Software Inc.)

Tcpip\..\Interfaces\{1F682D7F-7F47-4161-876D-BF1F0BF9F912}: [NameServer] 208.67.222.222 208.67.220.220
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin HKCU: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-12]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\*****\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2014-02-17]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-19] (AVAST Software)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2013-04-10] (ELAN Microelectronics Corp.)

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)

R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)

R2 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [563424 2009-11-10] (MKS Software Inc.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)

R2 PortmapperService; C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [676864 2014-02-02] (PTC) [File not signed]

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

R3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-19] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-19] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-19] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-19] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-19] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-19] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-19] ()

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-20] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)

R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-15 22:38 - 2014-10-15 22:38 - 00014617 _____ () C:\Users\*****\Downloads\FRST.txt

2014-10-15 22:38 - 2014-10-15 22:38 - 00000000 ____D () C:\Users\*****\Desktop\Neuer Ordner

2014-10-15 22:37 - 2014-10-15 22:38 - 00000000 ____D () C:\FRST

2014-10-15 22:36 - 2014-10-15 22:37 - 02111488 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe

2014-10-15 22:34 - 2014-10-15 22:35 - 00000472 _____ () C:\Users\*****\Downloads\defogger_disable.log

2014-10-15 22:34 - 2014-10-15 22:34 - 00000000 _____ () C:\Users\*****\defogger_reenable

2014-10-15 22:33 - 2014-10-15 22:33 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe

2014-10-15 18:41 - 2014-10-15 18:41 - 00000000 ____D () C:\Users\*****\Downloads\Kunststoff

2014-10-15 18:35 - 2014-10-15 18:37 - 00000000 ____D () C:\Users\*****\Downloads\Heizung

2014-10-15 18:34 - 2014-10-15 18:40 - 00000000 ____D () C:\Users\*****\Downloads\Fotobuch_Addon

2014-10-15 16:38 - 2014-10-15 22:06 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS

2014-10-15 16:38 - 2014-10-15 18:34 - 00000000 ____D () C:\Windows\AutoKMS

2014-10-15 16:30 - 2014-10-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit

2014-10-15 16:24 - 2014-10-15 16:29 - 51553449 _____ () C:\Users\*****\Downloads\mito225.rar

2014-10-15 16:13 - 2014-10-15 16:13 - 00000000 ____D () C:\Users\*****\AppData\Local\SFPC_Auto_Updater

2014-10-15 16:01 - 2014-10-15 16:01 - 00000659 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-10-15 15:58 - 2014-10-15 16:00 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Developerts LLC USA

2014-10-15 15:58 - 2014-10-15 15:59 - 00000000 ____D () C:\Users\*****\AppData\Roaming\OptimumPcBoost

2014-10-15 15:58 - 2014-10-15 15:58 - 00004014 _____ () C:\Windows\System32\Tasks\Secure Fast PC Auto Updater

2014-10-15 15:58 - 2014-10-15 15:58 - 00003942 _____ () C:\Windows\System32\Tasks\Optimum_Daily

2014-10-15 15:58 - 2014-10-15 15:58 - 00003570 _____ () C:\Windows\System32\Tasks\Secure Fast PC Autorun

2014-10-15 15:58 - 2014-10-15 15:58 - 00003512 _____ () C:\Windows\System32\Tasks\Optimum_LogOn

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Local\Developerts_LLC

2014-10-15 15:52 - 2014-10-15 15:52 - 00000000 ____D () C:\Users\*****\Downloads\Windows Activate  8.1 x64 & x86

2014-10-15 15:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-15 15:12 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-15 12:43 - 2014-10-15 14:59 - 00919163 _____ () C:\Users\Public\Documents\trail.txt.40

2014-10-14 23:32 - 2014-10-14 23:36 - 00129256 _____ () C:\Users\Public\Documents\trail.txt.39

2014-10-14 16:44 - 2014-10-14 23:32 - 03430078 _____ () C:\Users\Public\Documents\trail.txt.38

2014-10-14 10:00 - 2014-10-14 13:59 - 01911616 _____ () C:\Users\Public\Documents\trail.txt.37

2014-10-13 21:22 - 2014-10-14 00:56 - 02786659 _____ () C:\Users\Public\Documents\trail.txt.36

2014-10-13 20:44 - 2014-10-13 21:14 - 00319444 _____ () C:\Users\Public\Documents\trail.txt.35

2014-10-13 20:16 - 2014-10-15 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kotflügel

2014-10-13 19:38 - 2014-10-13 20:38 - 00124606 _____ () C:\Users\Public\Documents\trail.txt.34

2014-10-13 19:38 - 2014-10-13 19:38 - 00000000 ____D () C:\Users\*****\AppData\Roaming\NVIDIA

2014-10-13 14:07 - 2014-10-15 22:17 - 00005136 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop

2014-10-12 13:45 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-12 13:45 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-12 13:45 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-12 13:44 - 2014-08-29 03:32 - 02779136 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-12 13:44 - 2014-08-29 02:59 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-12 13:44 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-12 13:44 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-12 13:44 - 2014-08-26 00:27 - 04148736 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-12 13:44 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-12 13:44 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-12 13:44 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-12 13:44 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-12 13:44 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-12 13:44 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-12 13:44 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-12 13:44 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-12 13:44 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-12 13:44 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-12 13:44 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:20 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-12 13:44 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-12 13:44 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-12 13:44 - 2014-08-16 02:11 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-12 13:44 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-12 13:44 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-12 13:44 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieUserList

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieSiteList

2014-09-26 22:39 - 2014-09-26 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-19 19:35 - 2014-09-19 19:48 - 00000000 ____D () C:\Users\*****\Desktop\Bilder_IPHONE
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-15 22:37 - 2014-01-26 23:58 - 01601837 _____ () C:\Windows\WindowsUpdate.log

2014-10-15 22:34 - 2014-01-27 00:03 - 00000000 ____D () C:\Users\*****

2014-10-15 22:15 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-15 22:11 - 2014-01-27 00:09 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-835766522-2148508782-3467690004-1001

2014-10-15 22:10 - 2014-01-27 00:02 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-15 22:10 - 2013-09-30 05:58 - 00765582 _____ () C:\Windows\system32\perfh007.dat

2014-10-15 22:10 - 2013-09-30 05:58 - 00159366 _____ () C:\Windows\system32\perfc007.dat

2014-10-15 22:06 - 2014-01-27 00:05 - 00000000 ___DO () C:\Users\*****\SkyDrive

2014-10-15 22:04 - 2013-09-29 21:05 - 00543216 _____ () C:\Windows\PFRO.log

2014-10-15 22:04 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-15 22:04 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-15 22:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-15 21:56 - 2014-04-16 21:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-15 21:51 - 2014-04-16 21:14 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-15 18:42 - 2014-09-03 19:58 - 00163840 ___SH () C:\Users\*****\Downloads\Thumbs.db

2014-10-15 16:13 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\tracing

2014-10-15 12:43 - 2014-02-02 22:44 - 00000112 _____ () C:\Users\Public\Documents\std.err

2014-10-15 12:43 - 2014-02-02 22:44 - 00000038 _____ () C:\Users\Public\Documents\std.out

2014-10-13 19:49 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2014-10-13 19:38 - 2014-07-16 13:13 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF

2014-10-13 18:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-12 13:47 - 2014-04-11 20:25 - 00000000 ____D () C:\Users\*****\Documents\Mein Steuer-Sparbuch Heute

2014-10-12 13:47 - 2013-08-22 16:44 - 00498048 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-07 11:07 - 2014-01-27 23:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc

2014-10-07 10:29 - 2013-08-22 16:46 - 00051275 _____ () C:\Windows\setupact.log

2014-10-07 10:16 - 2014-02-16 13:50 - 00042496 ___SH () C:\Users\*****\Desktop\Thumbs.db

2014-09-29 21:33 - 2014-01-27 00:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-18 20:45 - 2013-09-30 06:00 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-09-18 20:45 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe

2014-09-16 22:02 - 2014-05-23 22:32 - 00000000 ____D () C:\Users\*****\Documents\Nancy

2014-09-15 19:42 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
 

Some content of TEMP:

====================

C:\Users\*****\AppData\Local\Temp\52377uninstall.exe

C:\Users\*****\AppData\Local\Temp\AcDeltree.exe

C:\Users\*****\AppData\Local\Temp\amazonicon_v4.exe

C:\Users\*****\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\*****\AppData\Local\Temp\BackupSetup.exe

C:\Users\*****\AppData\Local\Temp\Execute2App.exe

C:\Users\*****\AppData\Local\Temp\FNP_ACT_InstallerCA.dll

C:\Users\*****\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\*****\AppData\Local\Temp\HNK_2010.exe

C:\Users\*****\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe

C:\Users\*****\AppData\Local\Temp\msvcp90.dll

C:\Users\*****\AppData\Local\Temp\msvcr100.dll

C:\Users\*****\AppData\Local\Temp\msvcr90.dll

C:\Users\*****\AppData\Local\Temp\nitro_reader3_64.exe

C:\Users\*****\AppData\Local\Temp\PidGenX.dll

C:\Users\*****\AppData\Local\Temp\pimuninstall.exe

C:\Users\*****\AppData\Local\Temp\Quarantine.exe

C:\Users\*****\AppData\Local\Temp\sdanircmdc.exe

C:\Users\*****\AppData\Local\Temp\sdapskill.exe

C:\Users\*****\AppData\Local\Temp\sdaspwn.exe

C:\Users\*****\AppData\Local\Temp\Sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-13 19:46
 

==================== End Of Log ============================

--- --- ---

--- --- ---

und der Dritte:

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-10-15 22:55:50

Windows 6.2.9200  x64 \Device\Harddisk1\DR1 -> \Device\0000002c Crucial_CT120M500SSD3 rev.MU03 111,79GB

Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kgldapow.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text    C:\Windows\system32\wininit.exe[640] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\services.exe[696] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\lsass.exe[704] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                              00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\winlogon.exe[752] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[824] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[864] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\nvvsvc.exe[972] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                             00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                             00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                                    00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                                00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                                      00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                                      00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                                     00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                             00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                               00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                  00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                       00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                    00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                              00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                                       00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                                   00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                            00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                                   00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                                              00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                               00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                           00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\system32\dwm.exe[988] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                 00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                 00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                        00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                    00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                          00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                          00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                         00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                 00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                   00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                      00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                           00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                        00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                    00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                  00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                                        00007ffd19469318 7 bytes JMP 00007ffe18640538

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                         00007ffd1946cbe0 7 bytes JMP 00007ffe18640500

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                           00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                       00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                       00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                  00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                   00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                               00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[76] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                     00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Windows\system32\nvvsvc.exe[288] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                             00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\nvvsvc.exe[288] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                            00007ffd198c169a 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\system32\nvvsvc.exe[288] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                            00007ffd198c16a2 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\system32\nvvsvc.exe[288] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                               00007ffd198c181a 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\system32\nvvsvc.exe[288] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                               00007ffd198c1832 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\System32\svchost.exe[304] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\svchost.exe[468] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[548] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[896] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                            00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[1288] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\spoolsv.exe[1500] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\spoolsv.exe[1500] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                          00007ffd198c169a 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\System32\spoolsv.exe[1500] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                          00007ffd198c16a2 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\System32\spoolsv.exe[1500] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                             00007ffd198c181a 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\System32\spoolsv.exe[1500] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                             00007ffd198c1832 4 bytes [8C, 19, FD, 7F]

.text    C:\Windows\system32\svchost.exe[1560] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\AdminService.exe[1708] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                      00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Bonjour\mDNSResponder.exe[1744] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Elantech\ETDService.exe[1772] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                  00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\dashost.exe[1816] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe[1844] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                        00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\nutsrv4.exe[1896] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2004] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[1572] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\svchost.exe[2404] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\wbem\wmiprvse.exe[2456] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2632] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\conhost.exe[2640] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\wbem\unsecapp.exe[2748] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\wbem\wmiprvse.exe[3056] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                     00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                            00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                        00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                              00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                              00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                             00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                     00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                       00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                          00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                               00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                            00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                        00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                      00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\SYSTEM32\user32.dll!CreateWindowExW                                                                                                               00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\SYSTEM32\user32.dll!EnumDisplayDevicesW                                                                                                           00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\SYSTEM32\user32.dll!DisplayConfigGetDeviceInfo                                                                                                    00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\SYSTEM32\user32.dll!EnumDisplayDevicesA                                                                                                           00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\SYSTEM32\user32.dll!ChangeDisplaySettingsExW                                                                                                      00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                       00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                   00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\system32\taskhostex.exe[2788] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                         00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                        00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                               00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                 00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                 00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                        00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                          00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                             00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                  00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                               00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                           00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                         00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                  00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                              00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                       00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                              00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                         00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                          00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                      00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                            00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\SYSTEM32\d3d9.dll!Direct3DCreate9Ex                                                                                  00007ffd0f92a204 4 bytes JMP 00007ffd186405a8

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\SYSTEM32\d3d9.dll!Direct3DCreate9                                                                                    00007ffd0f9422cc 6 bytes JMP 00007ffd18640570

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                               00007ffd19469318 7 bytes JMP 00007ffe18640538

.text    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3008] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                00007ffd1946cbe0 7 bytes JMP 00007ffe18640500

.text    C:\Windows\system32\conhost.exe[1416] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\Explorer.EXE[3084] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                                   00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                  00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                         00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                           00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                           00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                          00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                  00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                    00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                       00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                            00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                         00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                     00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                   00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                            00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                        00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                 00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                        00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                                   00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                    00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                      00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                                                         00007ffd19469318 7 bytes JMP 00007ffe18640538

.text    C:\Program Files\Elantech\ETDCtrl.exe[3488] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                                          00007ffd1946cbe0 7 bytes JMP 00007ffe18640500

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                 00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                        00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                    00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                          00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                          00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                         00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                 00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                   00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                      00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                           00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                        00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                    00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                  00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                           00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                       00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                       00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                                  00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                   00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                               00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Program Files\Elantech\ETDTouch.exe[4076] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                     00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                            00007ffd18fb28c0 7 bytes JMP 00007ffe18590260

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                   00007ffd18fb43d8 7 bytes JMP 00007ffe18590298

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                               00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                     00007ffd19061f20 7 bytes JMP 00007ffe18590308

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                     00007ffd190640b4 7 bytes JMP 00007ffe18590340

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                    00007ffd19064510 7 bytes JMP 00007ffe185902d0

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                            00007ffd1908cea0 7 bytes JMP 00007ffe185901f0

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                              00007ffd1908cf10 7 bytes JMP 00007ffe18590228

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                 00007ffd186a299c 7 bytes JMP 00007ffe185900d8

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                      00007ffd186a54c8 5 bytes JMP 00007ffe18590180

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                   00007ffd186a55b0 5 bytes JMP 00007ffe18590148

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                               00007ffd186a5e58 5 bytes JMP 00007ffe18590110

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                             00007ffd18716200 5 bytes JMP 00007ffe185901b8

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                      00007ffd1968b6f4 10 bytes JMP 00007ffe18590420

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                  00007ffd196945e8 5 bytes JMP 00007ffe185903e8

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                           00007ffd19694760 9 bytes JMP 00007ffe18590378

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                  00007ffd196a4fc0 5 bytes JMP 00007ffe185903b0

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                             00007ffd196a5cb0 5 bytes JMP 00007ffe18590458

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                              00007ffd18b01500 1 byte JMP 00007ffe18590490

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                          00007ffd18b01502 6 bytes {JMP 0xffffffffffa8ef90}

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                00007ffd18b01750 8 bytes JMP 00007ffe185904c8

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                                                   00007ffd19469318 7 bytes JMP 00007ffe18590538

.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4060] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                                    00007ffd1946cbe0 7 bytes JMP 00007ffe18590500

.text    C:\Windows\system32\SearchIndexer.exe[1440] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                 00007ffd18fb28c0 7 bytes JMP 00007ffe18590260

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                        00007ffd18fb43d8 7 bytes JMP 00007ffe18590298

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                    00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                          00007ffd19061f20 7 bytes JMP 00007ffe18590308

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                          00007ffd190640b4 7 bytes JMP 00007ffe18590340

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                         00007ffd19064510 7 bytes JMP 00007ffe185902d0

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                 00007ffd1908cea0 7 bytes JMP 00007ffe185901f0

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                   00007ffd1908cf10 7 bytes JMP 00007ffe18590228

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                      00007ffd186a299c 7 bytes JMP 00007ffe185900d8

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                           00007ffd186a54c8 5 bytes JMP 00007ffe18590180

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                        00007ffd186a55b0 5 bytes JMP 00007ffe18590148

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                    00007ffd186a5e58 5 bytes JMP 00007ffe18590110

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                  00007ffd18716200 5 bytes JMP 00007ffe185901b8

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                           00007ffd1968b6f4 10 bytes JMP 00007ffe18590420

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                       00007ffd196945e8 5 bytes JMP 00007ffe185903e8

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                00007ffd19694760 9 bytes JMP 00007ffe18590378

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                       00007ffd196a4fc0 5 bytes JMP 00007ffe185903b0

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                  00007ffd196a5cb0 5 bytes JMP 00007ffe18590458

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                   00007ffd18b01500 1 byte JMP 00007ffe18590490

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                               00007ffd18b01502 6 bytes {JMP 0xffffffffffa8ef90}

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                     00007ffd18b01750 8 bytes JMP 00007ffe185904c8

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                                        00007ffd19469318 7 bytes JMP 00007ffe18590538

.text    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1056] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                         00007ffd1946cbe0 7 bytes JMP 00007ffe18590500

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                        00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                               00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                                 00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                                 00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                                00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                        00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                          00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                             00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                  00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                               00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                           00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                         00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                                                               00007ffd19469318 7 bytes JMP 00007ffe18640538

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance                                                                                                                00007ffd1946cbe0 7 bytes JMP 00007ffe18640500

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                          00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                      00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                            00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                                  00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                              00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                       00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                              00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\System32\skydrive.exe[984] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                                         00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[2984] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                        00007ffd18fc553d 1 byte [62]

.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[2984] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                                                             00007ffd136d1f6a 4 bytes [6D, 13, FD, 7F]

.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[2984] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                                                             00007ffd136d1f82 4 bytes [6D, 13, FD, 7F]

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                  00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                         00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                           00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                           00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                          00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                  00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                    00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                       00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                            00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                         00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                     00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                   00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                            00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                        00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                 00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                        00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                   00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                    00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE[4684] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                      00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                  00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                         00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                     00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                           00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                           00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                          00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                  00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                    00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                       00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                            00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                         00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                     00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                   00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\SYSTEM32\user32.dll!CreateWindowExW                                                                                                            00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\SYSTEM32\user32.dll!EnumDisplayDevicesW                                                                                                        00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\SYSTEM32\user32.dll!DisplayConfigGetDeviceInfo                                                                                                 00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\SYSTEM32\user32.dll!EnumDisplayDevicesA                                                                                                        00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\SYSTEM32\user32.dll!ChangeDisplaySettingsExW                                                                                                   00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                    00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\system32\wbem\unsecapp.exe[4996] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                      00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Program Files\iPod\bin\iPodService.exe[4444] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                 00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                       00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                   00007ffd18fc553d 1 byte [62]

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                         00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                         00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                        00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                  00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                     00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                          00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                       00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                   00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\System32\SettingSyncHost.exe[5296] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                 00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                                        00007ffd18fb28c0 7 bytes JMP 00007ffe18640260

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW                                                                                                               00007ffd18fb43d8 7 bytes JMP 00007ffe18640298

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA                                                                                                                 00007ffd19061f20 7 bytes JMP 00007ffe18640308

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW                                                                                                                 00007ffd190640b4 7 bytes JMP 00007ffe18640340

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW                                                                                                                00007ffd19064510 7 bytes JMP 00007ffe186402d0

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                                        00007ffd1908cea0 7 bytes JMP 00007ffe186401f0

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                                          00007ffd1908cf10 7 bytes JMP 00007ffe18640228

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                             00007ffd186a299c 7 bytes JMP 00007ffe186400d8

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                  00007ffd186a54c8 5 bytes JMP 00007ffe18640180

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                               00007ffd186a55b0 5 bytes JMP 00007ffe18640148

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                           00007ffd186a5e58 5 bytes JMP 00007ffe18640110

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW                                                                                                         00007ffd18716200 5 bytes JMP 00007ffe186401b8

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                                  00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                              00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                       00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                              00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                                                         00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                          00007ffd18b01500 1 byte JMP 00007ffe18640490

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2                                                                                                      00007ffd18b01502 6 bytes {JMP 0xffffffffffb3ef90}

.text    C:\Windows\system32\taskeng.exe[5668] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                            00007ffd18b01750 8 bytes JMP 00007ffe186404c8

.text    C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe[4724] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                         00007ffd1968b6f4 10 bytes JMP 00007ffe18640420

.text    C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe[4724] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                     00007ffd196945e8 5 bytes JMP 00007ffe186403e8

.text    C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe[4724] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                              00007ffd19694760 9 bytes JMP 00007ffe18640378

.text    C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe[4724] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                     00007ffd196a4fc0 5 bytes JMP 00007ffe186403b0

.text    C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe[4724] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW                                                                00007ffd196a5cb0 5 bytes JMP 00007ffe18640458

.text    C:\Windows\system32\AUDIODG.EXE[5072] C:\Windows\SYSTEM32\KERNEL32.DLL!GetBinaryTypeW + 165                                                                                                           00007ffd18fc553d 1 byte [62]
 

---- Threads - GMER 2.1 ----
 

Thread   C:\Windows\system32\csrss.exe [648:672]                                                                                                                                                               fffff96000883b90

Thread   C:\Windows\system32\svchost.exe [548:5260]                                                                                                                                                            00007ffd0e8910e0

Thread   C:\Windows\system32\svchost.exe [548:4672]                                                                                                                                                            00007ffd135238e0

Thread   C:\Windows\Explorer.EXE [3084:5856]                                                                                                                                                                   00007ffd11f7d73c

---- Processes - GMER 2.1 ----
 

Process  C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe (*** suspicious ***) @ C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe [4724](2014-10-02 11:24:00)  0000000000cf0000
 

---- Registry - GMER 2.1 ----
 

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime                                                                                                                                     0x62 0xBA 0xE5 0xCF ...

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime                                                                                                                                 0x9B 0x9A 0x0E 0x5D ...

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime                                                                                                                                        0xBD 0x08 0xE6 0xCF ...

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime                                                                                                                                    0x84 0x55 0x14 0xE8 ...

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@de-DE                                                                                                                                 51

Reg      HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\AUO12ED0_00_07DC_95^039255CF9C6747F8F32810EF7488A6F0@Timestamp                                                                    0x3B 0xEE 0xA4 0x51 ...

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid                                                                                                                                                      700

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{B6BD6744-D44E-4AEB-8EA3-18DF45F0A88F}\Connection@Name                                                           Reusable ISATAP Interface {B6BD6744-D44E-4AEB-8EA3-18DF45F0A88F}

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations                                                                                                                     \??\C:\$Recycle.Bin\S-1-5-21-835766522-2148508782-3467690004-1001\$RODSHLK.exe??\??\C:\Users\*****\AppData\Local\Temp\fullpackage_temp1397246295\qSE.exe??

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber                                                                                                                    3900032

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                                                                                     662445302

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId                                                                                                     55

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime                                                                                                   424886358

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime                                                                                                                                  0

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime                                                                                                                                3184

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID                                                                                                                                      9887e116-9012-4af9-8881-c07bfa2

Reg      HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter                                                                                                                        1

Reg      HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters@BootCounter                                                                                                                                 18

Reg      HKLM\SYSTEM\CurrentControlSet\Services\BITS@Start                                                                                                                                                     3

Reg      HKLM\SYSTEM\CurrentControlSet\Services\BITS                                                                                                                                                           

Reg      HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\485ab68b48d6                                                                                                                           

Reg      HKLM\SYSTEM\CurrentControlSet\Services\bthserv\Parameters\BluetoothControlPanelTasks@State                                                                                                            0

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{3cc046a9-bb06-42cb-9277-3544cd18e41a}@LastProbeTime                                                                                 1413398042

Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{B6BD6744-D44E-4AEB-8EA3-18DF45F0A88F}@InterfaceName                                                                                Reusable ISATAP Interface {B6BD6744-D44E-4AEB-8EA3-18DF45F0A88F}

Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{B6BD6744-D44E-4AEB-8EA3-18DF45F0A88F}@ReusableType                                                                                 2

Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{DCA11EED-C43D-46AE-B42D-A7BFB67E5E7B}@DefunctTimestamp                                                                             0xC6 0xA1 0x3E 0x54 ...

Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                                                                       5335

Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                                                                      1944

Reg      HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence                                                                                                                                53

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@DhcpDomain                                                                                                                                    fritz.box

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@DhcpNameServer                                                                                                                                192.168.178.1

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C87837F6-FA2F-43A3-8DDB-22CB2CE080E1}@LeaseObtainedTime                                                                           1413398784

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C87837F6-FA2F-43A3-8DDB-22CB2CE080E1}@T1                                                                                          1413830784

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C87837F6-FA2F-43A3-8DDB-22CB2CE080E1}@T2                                                                                          1414154784

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C87837F6-FA2F-43A3-8DDB-22CB2CE080E1}@LeaseTerminatesTime                                                                         1414262784

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop                                                                                                                      0

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown                                                                                                                        1

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\iexplore@Count                                                                                        375

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsRequestBucketCounter                                                                                                    99

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime                                                                                              0x02 0x93 0xB4 0xFE ...

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime                                                                                         0x02 0x93 0xB4 0xFE ...

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime                                                                                                0x02 0x93 0xB4 0xFE ...

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalRequestBucketCounter                                                                                                     99

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime                                                                                               0x02 0x93 0xB4 0xFE ...

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken                                                                                                               LM%3d63548999760933%3bID%3d65D7AE8ADF8DDD53!104%3bLR%3d63548999761567%3bEP%3d4%3bTD%3dTrue

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                                                                                0x73 0x93 0xA1 0xB1 ...
 

---- EOF - GMER 2.1 ----

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Guten Abend,

hier die benötigten Logs:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 16.10.2014

Suchlauf-Zeit: 20:16:38

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.10.16.05

Rootkit Datenbank: v2014.10.15.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 8.1

CPU: x64

Dateisystem: NTFS

Benutzer: *****
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 316882

Verstrichene Zeit: 6 Min, 31 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 0

(No malicious items detected)
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Code:

# AdwCleaner v4.000 - Bericht erstellt am 16/10/2014 um 20:32:14

# DB v2014-10-15.7

# Aktualisiert 12/10/2014 von Xplode

# Betriebssystem : Windows 8.1 Pro  (64 bits)

# Benutzername : ***** - *****_LAPTOP

# Gestartet von : C:\Users\*****\Downloads\AdwCleaner_4.000.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Tasks ] *****
 

Task Gelöscht : Digital Sites

Task Gelöscht : FoxTab
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKCU\Software\IM

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17278
 
 

-\\ Mozilla Firefox v32.0.3 (x86 de)
 
 

*************************
 

AdwCleaner[R0].txt - [2902 octets] - [16/04/2014 21:28:02]

AdwCleaner[R1].txt - [2415 octets] - [16/10/2014 20:26:42]

AdwCleaner[R2].txt - [2475 octets] - [16/10/2014 20:30:34]

AdwCleaner[S0].txt - [2454 octets] - [16/04/2014 21:32:57]

AdwCleaner[S1].txt - [2289 octets] - [16/10/2014 20:32:14]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2349 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.3 (10.14.2014:1)

OS: Windows 8.1 Pro x64

Ran by ***** on 16.10.2014 at 20:40:52,24

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC-STANDALONE-SETUP.-B3D7416C.pf

Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC.TMP-EE55A3C6.pf
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\emjgm50o.default-1397678037534\minidumps [10 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 16.10.2014 at 20:43:37,94

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 02

Ran by ***** (administrator) on *****_LAPTOP on 16-10-2014 20:50:16

Running from C:\Users\*****\Downloads

Loaded Profile: ***** (Available profiles: *****)

Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Atheros Commnucations) C:\Windows\System32\AdminService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

(MKS Software Inc.) C:\Windows\System32\nutsrv4.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(PTC) C:\Program Files\PTC\PTC Portmapper\i486_nt\obj\portmap.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE

() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-10] (ELAN Microelectronics Corp.)

HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [NuTCSetupEnviron] => C:\Program Files\PTC\MKS Toolkit\bin\ncoeenv.exe [37160 2009-11-23] (MKS Software Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-15] (AVAST Software)

HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-835766522-2148508782-3467690004-1001\...\Run: [EPSON BX525WD Series (Kopie 1)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/software/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin HKCU: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\searchplugins\google-maps.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Cliqz Beta - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\Extensions\cliqz@cliqz.com.xpi [2014-10-15]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-12]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-19] (AVAST Software)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2013-04-10] (ELAN Microelectronics Corp.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)

R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)

R2 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [563424 2009-11-10] (MKS Software Inc.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)

R2 PortmapperService; C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [676864 2014-02-02] (PTC) [File not signed]

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

R3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-19] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-19] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-19] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-19] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-19] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-19] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-19] ()

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-20] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)

R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-16 20:50 - 2014-10-16 20:50 - 00014131 _____ () C:\Users\*****\Downloads\FRST.txt

2014-10-16 20:43 - 2014-10-16 20:43 - 00000936 _____ () C:\Users\*****\Desktop\JRT.txt

2014-10-16 20:37 - 2014-10-16 20:37 - 01705698 _____ (Thisisu) C:\Users\*****\Downloads\JRT(1).exe

2014-10-16 20:25 - 2014-10-16 20:25 - 01976320 _____ () C:\Users\*****\Downloads\AdwCleaner_4.000.exe

2014-10-16 08:55 - 2014-10-16 08:55 - 00000000 ____D () C:\Users\*****\Documents\Fax

2014-10-15 22:49 - 2014-10-15 22:49 - 00380416 _____ () C:\Users\*****\Downloads\Gmer-19357.exe

2014-10-15 22:38 - 2014-10-16 20:24 - 00000000 ____D () C:\Users\*****\Desktop\Trojaner

2014-10-15 22:37 - 2014-10-16 20:50 - 00000000 ____D () C:\FRST

2014-10-15 22:36 - 2014-10-15 22:37 - 02111488 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe

2014-10-15 22:34 - 2014-10-15 22:35 - 00000472 _____ () C:\Users\*****\Downloads\defogger_disable.log

2014-10-15 22:34 - 2014-10-15 22:34 - 00000000 _____ () C:\Users\*****\defogger_reenable

2014-10-15 22:33 - 2014-10-15 22:33 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe

2014-10-15 22:17 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 22:17 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 22:17 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 22:17 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 22:16 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 22:16 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 22:16 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 22:16 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 22:16 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 22:16 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 22:16 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 22:16 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 22:16 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 22:16 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 22:16 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 22:16 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 22:16 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 22:16 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 22:15 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 22:15 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 22:15 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 22:15 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 22:15 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 22:15 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 22:15 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 22:15 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 22:15 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 22:15 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 22:15 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 22:15 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 22:15 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 22:15 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 22:15 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 22:15 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 22:15 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 22:15 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 22:15 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 22:15 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 22:15 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 22:15 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 22:15 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 22:15 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 22:15 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 22:15 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 22:15 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 22:15 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 22:15 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 22:15 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 22:15 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 22:15 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 22:15 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 22:15 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 22:15 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 22:15 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 18:41 - 2014-10-15 18:41 - 00000000 ____D () C:\Users\*****\Downloads\Kunststoff

2014-10-15 18:35 - 2014-10-16 13:47 - 00000000 ____D () C:\Users\*****\Downloads\Heizung

2014-10-15 18:34 - 2014-10-15 18:40 - 00000000 ____D () C:\Users\*****\Downloads\Fotobuch_Addon

2014-10-15 16:38 - 2014-10-16 20:35 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS

2014-10-15 16:38 - 2014-10-15 18:34 - 00000000 ____D () C:\Windows\AutoKMS

2014-10-15 16:30 - 2014-10-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit

2014-10-15 16:24 - 2014-10-15 16:29 - 51553449 _____ () C:\Users\*****\Downloads\mito225.rar

2014-10-15 16:13 - 2014-10-15 16:13 - 00000000 ____D () C:\Users\*****\AppData\Local\SFPC_Auto_Updater

2014-10-15 16:01 - 2014-10-15 16:01 - 00000659 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-10-15 15:58 - 2014-10-15 16:00 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Developerts LLC USA

2014-10-15 15:58 - 2014-10-15 15:59 - 00000000 ____D () C:\Users\*****\AppData\Roaming\OptimumPcBoost

2014-10-15 15:58 - 2014-10-15 15:58 - 00004014 _____ () C:\Windows\System32\Tasks\Secure Fast PC Auto Updater

2014-10-15 15:58 - 2014-10-15 15:58 - 00003942 _____ () C:\Windows\System32\Tasks\Optimum_Daily

2014-10-15 15:58 - 2014-10-15 15:58 - 00003570 _____ () C:\Windows\System32\Tasks\Secure Fast PC Autorun

2014-10-15 15:58 - 2014-10-15 15:58 - 00003512 _____ () C:\Windows\System32\Tasks\Optimum_LogOn

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Local\Developerts_LLC

2014-10-15 15:52 - 2014-10-15 15:52 - 00000000 ____D () C:\Users\*****\Downloads\Windows Activate  8.1 x64 & x86

2014-10-15 15:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-15 15:12 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-15 12:43 - 2014-10-15 14:59 - 00919163 _____ () C:\Users\Public\Documents\trail.txt.40

2014-10-14 23:32 - 2014-10-14 23:36 - 00129256 _____ () C:\Users\Public\Documents\trail.txt.39

2014-10-14 16:44 - 2014-10-14 23:32 - 03430078 _____ () C:\Users\Public\Documents\trail.txt.38

2014-10-14 10:00 - 2014-10-14 13:59 - 01911616 _____ () C:\Users\Public\Documents\trail.txt.37

2014-10-13 21:22 - 2014-10-14 00:56 - 02786659 _____ () C:\Users\Public\Documents\trail.txt.36

2014-10-13 20:44 - 2014-10-13 21:14 - 00319444 _____ () C:\Users\Public\Documents\trail.txt.35

2014-10-13 20:16 - 2014-10-15 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kotflügel

2014-10-13 19:38 - 2014-10-13 20:38 - 00124606 _____ () C:\Users\Public\Documents\trail.txt.34

2014-10-13 19:38 - 2014-10-13 19:38 - 00000000 ____D () C:\Users\*****\AppData\Roaming\NVIDIA

2014-10-13 14:07 - 2014-10-16 20:47 - 00005136 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop

2014-10-12 13:45 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-12 13:45 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-12 13:45 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-12 13:44 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-12 13:44 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-12 13:44 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-12 13:44 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-12 13:44 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-12 13:44 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-12 13:44 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-12 13:44 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-12 13:44 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-12 13:44 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-12 13:44 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-12 13:44 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-12 13:44 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-12 13:44 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-12 13:44 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-12 13:44 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-12 13:44 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieUserList

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieSiteList

2014-09-26 22:39 - 2014-09-26 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-19 19:35 - 2014-09-19 19:48 - 00000000 ____D () C:\Users\*****\Desktop\Bilder_IPHONE
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-16 20:41 - 2014-01-27 00:02 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-16 20:41 - 2013-09-30 05:58 - 00765582 _____ () C:\Windows\system32\perfh007.dat

2014-10-16 20:41 - 2013-09-30 05:58 - 00159366 _____ () C:\Windows\system32\perfc007.dat

2014-10-16 20:34 - 2014-04-11 20:25 - 00000000 ____D () C:\Users\*****\Documents\Mein Steuer-Sparbuch Heute

2014-10-16 20:34 - 2014-01-27 00:05 - 00000000 ___DO () C:\Users\*****\SkyDrive

2014-10-16 20:34 - 2013-09-29 21:05 - 00543778 _____ () C:\Windows\PFRO.log

2014-10-16 20:34 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-16 20:34 - 2013-08-22 16:44 - 00498048 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-16 20:33 - 2014-01-26 23:58 - 01697620 _____ () C:\Windows\WindowsUpdate.log

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera

2014-10-16 20:33 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-16 20:32 - 2014-04-16 21:27 - 00000000 ____D () C:\AdwCleaner

2014-10-16 20:16 - 2014-04-16 21:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-16 20:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-16 08:42 - 2014-01-27 00:13 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-16 08:42 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-16 08:40 - 2014-01-27 00:13 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 23:18 - 2014-01-27 00:09 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-835766522-2148508782-3467690004-1001

2014-10-15 22:34 - 2014-01-27 00:03 - 00000000 ____D () C:\Users\*****

2014-10-15 21:51 - 2014-04-16 21:14 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-15 18:42 - 2014-09-03 19:58 - 00163840 ___SH () C:\Users\*****\Downloads\Thumbs.db

2014-10-15 16:13 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\tracing

2014-10-15 12:43 - 2014-02-02 22:44 - 00000112 _____ () C:\Users\Public\Documents\std.err

2014-10-15 12:43 - 2014-02-02 22:44 - 00000038 _____ () C:\Users\Public\Documents\std.out

2014-10-13 19:49 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2014-10-13 19:38 - 2014-07-16 13:13 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF

2014-10-13 18:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-07 11:07 - 2014-01-27 23:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc

2014-10-07 10:29 - 2013-08-22 16:46 - 00051275 _____ () C:\Windows\setupact.log

2014-10-07 10:16 - 2014-02-16 13:50 - 00042496 ___SH () C:\Users\*****\Desktop\Thumbs.db

2014-09-30 00:45 - 2013-08-22 17:38 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-30 00:45 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-29 21:33 - 2014-01-27 00:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-18 20:45 - 2013-09-30 06:00 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-09-18 20:45 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe

2014-09-16 22:02 - 2014-05-23 22:32 - 00000000 ____D () C:\Users\*****\Documents\Nancy
 

Some content of TEMP:

====================

C:\Users\*****\AppData\Local\Temp\52377uninstall.exe

C:\Users\*****\AppData\Local\Temp\AcDeltree.exe

C:\Users\*****\AppData\Local\Temp\amazonicon_v4.exe

C:\Users\*****\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\*****\AppData\Local\Temp\BackupSetup.exe

C:\Users\*****\AppData\Local\Temp\Execute2App.exe

C:\Users\*****\AppData\Local\Temp\FNP_ACT_InstallerCA.dll

C:\Users\*****\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\*****\AppData\Local\Temp\HNK_2010.exe

C:\Users\*****\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe

C:\Users\*****\AppData\Local\Temp\msvcp90.dll

C:\Users\*****\AppData\Local\Temp\msvcr100.dll

C:\Users\*****\AppData\Local\Temp\msvcr90.dll

C:\Users\*****\AppData\Local\Temp\nitro_reader3_64.exe

C:\Users\*****\AppData\Local\Temp\PidGenX.dll

C:\Users\*****\AppData\Local\Temp\pimuninstall.exe

C:\Users\*****\AppData\Local\Temp\Quarantine.exe

C:\Users\*****\AppData\Local\Temp\sdanircmdc.exe

C:\Users\*****\AppData\Local\Temp\sdapskill.exe

C:\Users\*****\AppData\Local\Temp\sdaspwn.exe

C:\Users\*****\AppData\Local\Temp\Sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-13 19:46
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-10-2014 02

Ran by ***** at 2014-10-16 20:50:44

Running from C:\Users\*****\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Creo Thumbnail Viewer 2.0 (HKLM\...\{3F8CCE46-EAFD-4283-9ADB-7025EAC2CF64}) (Version: 30.12.480 - PTC)

Designer 2.0 (HKLM-x32\...\Designer 2.0_is1) (Version: 7.9.6 - Fomanu AG)

EPSON BX525WD Series Printer Uninstall (HKLM\...\EPSON BX525WD Series) (Version:  - SEIKO EPSON Corporation)

ETDWare PS/2-X64 11.6.22.201_WHQL (HKLM\...\Elantech) (Version: 11.6.22.201 - ELAN Microelectronic Corp.)

iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)

Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

MKS Platform Components 9.x (HKLM\...\{30023972-0000-0903-9ABB-000BDB5CF35D}) (Version: 9.3.0000 - Mortice Kern Systems)

Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)

NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden

NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDF-XChange Editor (HKLM-x32\...\{87738bc6-bdf0-4e55-86b5-32ddece8f51d}) (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.)

PDF-XChange Editor (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.) Hidden

Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.)

Samsung Kies3 (x32 Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.) Hidden

SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden

VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)

WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

28-09-2014 10:14:08 Windows Modules Installer

12-10-2014 11:45:06 Windows Update

15-10-2014 14:00:54 Removed Optimum PC Boost
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {24CEFABA-9030-40FB-BFAA-9E04940F6B71} - System32\Tasks\Optimum_LogOn => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {34F2800C-218C-4493-B520-02E7D528467D} - System32\Tasks\Secure Fast PC Auto Updater => C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe [2014-10-02] ()

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {448BAD6D-F25C-4722-ABAC-26BA66020C35} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-16] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {54563E16-A00B-4B48-A263-DB6B9422D70C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {6388F555-9135-46AF-9F1B-4BAFB6FB0C91} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-10-15] ()

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {6E8769E4-B628-47C0-B468-F349793D9594} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {75DB2D10-5C76-483B-98F9-DB654B2A08EB} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {7EBDCA38-F63D-4DF7-B6B8-D6182402285D} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {8677F14A-FF43-4CE0-9EA7-F73DEDD3B8AA} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {9B5D8BD6-5619-4E34-ABC9-6456A17CC707} - System32\Tasks\Optimum_Daily => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {9DB07B69-CE48-436F-BE9A-FD809EFBA494} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {9EAF8CB8-1FC6-4C8F-8D66-7E95E4BC0BF2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {B5805C99-52AB-4A13-8DF8-98CB3574508A} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {B8EEEEDB-BEC3-48D3-8AB1-3E75E328D19C} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {C0017E72-34E6-454E-BD30-C4974CD6B77A} - System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {E7B7DC04-38BC-4B75-81FE-F23C12A2E2E6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-19] (AVAST Software)

Task: {EF3F3EE7-C823-4AB9-A716-0BDA67B410DD} - System32\Tasks\Secure Fast PC Autorun => C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe

Task: {FEC944E4-4B72-4175-B1DB-9C72EEF41725} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
 

==================== Loaded Modules (whitelisted) =============
 

2014-09-12 21:40 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-04-09 21:33 - 2014-07-02 10:13 - 01427736 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2014-10-16 20:28 - 2014-10-16 20:28 - 02874368 _____ () C:\Program Files\AVAST Software\Avast\defs\14101601\algo.dll

2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 09789208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll

2014-04-09 21:32 - 2014-07-02 10:14 - 03880216 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00035608 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00322840 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00309016 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02738456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 01043456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00250368 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00136472 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02116376 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01932568 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00094720 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 04326168 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01564952 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 05291288 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01698584 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01809688 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01627928 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01117976 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01341208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01309464 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 07340824 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01286936 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01331480 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll

2014-04-12 13:48 - 2014-04-12 13:48 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-09-26 22:39 - 2014-09-26 22:39 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\*****\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

HKLM\...\StartupApproved\Run: => "HotKeysCmds"

HKLM\...\StartupApproved\Run: => "IgfxTray"

HKLM\...\StartupApproved\Run: => "Persistence"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-835766522-2148508782-3467690004-500 - Administrator - Disabled)

Gast (S-1-5-21-835766522-2148508782-3467690004-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-835766522-2148508782-3467690004-1003 - Limited - Enabled)

***** (S-1-5-21-835766522-2148508782-3467690004-1001 - Administrator - Enabled) => C:\Users\*****
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-19 22:49:34.167

  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz

Percentage of memory in use: 16%

Total physical RAM: 8076.36 MB

Available physical RAM: 6729.63 MB

Total Pagefile: 9356.36 MB

Available Pagefile: 7789.43 MB

Total Virtual: 131072 MB

Available Virtual: 131071.84 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:111.79 GB) (Free:42.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Volume) (Fixed) (Total:465.67 GB) (Free:380.82 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 285EB630)

Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo hier die neuen logs:

Code:

 Results of screen317's Security Check version 0.99.87  

   x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Windows Defender   

avast! Antivirus   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

  Adobe Flash Player         12.0.0.43 Flash Player out of Date!  

 Mozilla Firefox (32.0.3) 
 ````````Process Check: objlist.exe by Laurent````````  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast avastui.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

Code:

ESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

Can not open internet# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=b827b483cc02384782272072fcd9a5ef

# engine=20661

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-10-18 03:30:54

# local_time=2014-10-18 05:30:54 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 100 95 4310705 16342926 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 11164546 18029775 0 0

# scanned=287205

# found=19

# cleaned=19

# scan_time=17327

sh=A154BD6A65F49330614E5A6F7AD226F097A63CC1 ft=1 fh=c71c00116714754f vn="Variante von Win32/InstallCore.IX evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-835766522-2148508782-3467690004-1001\$R8UWCKO.exe"

sh=BDB3C48DE02EE29D0B72000619E4A00243B447F9 ft=1 fh=9da4402dbcebd4bb vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-835766522-2148508782-3467690004-1001\$RINA91C.exe"

sh=A154BD6A65F49330614E5A6F7AD226F097A63CC1 ft=1 fh=c71c00116714754f vn="Variante von Win32/InstallCore.IX evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-835766522-2148508782-3467690004-1001\$RU3YZG3.exe"

sh=E6B332BCE538D483BD4D5E135E011267F31EA813 ft=0 fh=0000000000000000 vn="Variante von MSIL/Riskware.HackTool.WinActivator.A Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-835766522-2148508782-3467690004-1001\$RX14R3N.part"

sh=4F2D43FFB1775DFE2101529769637B9741E2D473 ft=1 fh=7bf72ba7e7e381f9 vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\RegClean Pro\systweakasp.exe.vir"

sh=476063885747EDD774A6B8CB2790703503A75A55 ft=1 fh=d7bb79193adaee2e vn="Win32/Systweak.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Klaus\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"

sh=B2141692BDF56352A137D83E9EC73D05C423D2E5 ft=1 fh=e9e99cb68f1bf246 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Microsoft\Windows\INetCache\IE\9KT8GB8F\SpeedUpMyPC-standalone-setup[1].exe"

sh=7ABA4DC9BC22D9605675C22CEC12A0DB7EAF0937 ft=1 fh=e11cb87d8b8a9b76 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Microsoft\Windows\INetCache\IE\9KT8GB8F\SPSetup[1].exe"

sh=7028F239FAC673EE7DC7772ACC75D759EA73837D ft=1 fh=e769f095fe49f653 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Microsoft\Windows\INetCache\IE\R3PT2NUF\spstub[1].exe"

sh=A154BD6A65F49330614E5A6F7AD226F097A63CC1 ft=1 fh=c71c00116714754f vn="Variante von Win32/InstallCore.IX evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe"

sh=1A9C2CE8C1F539AC8546D67C9F924AEA8D2A84C2 ft=1 fh=d348c3328e970e39 vn="Win32/MyPCBackup.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\58b9d9ce-b709-44ba-a9e7-cab5b52164d9\software\Cloud_Backup_Setup.exe"

sh=CB4D3F50CE0911003DAC96EFC8B8B78AC54AF9C7 ft=1 fh=4e041820906d5a7a vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\58b9d9ce-b709-44ba-a9e7-cab5b52164d9\software\speedupmypc.exe"

sh=37182E163FDF9FCB2546299F1F0615B6F74D262B ft=1 fh=18b6a7542bfd5928 vn="Win32/VOPackage.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\58b9d9ce-b709-44ba-a9e7-cab5b52164d9\software\VOPackage.exe"

sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\89313968.Uninstall\uninstaller.exe"

sh=B2141692BDF56352A137D83E9EC73D05C423D2E5 ft=1 fh=e9e99cb68f1bf246 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\is-RBF2O.tmp\SpeedUpMyPC-standalone-setup.exe"

sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\is357113909\88831327_stp\wajam_validate.exe"

sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\is357113909\88982136_stp\wajam_validate.exe"

sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Local\Temp\is357113909\88982670_stp\uninstaller.exe"

sh=19F82F87E7CBB5CCEB46ECA4CE73915B50CE846C ft=1 fh=869f0bc47b2190f1 vn="Variante von MSIL/FakeAlert.A Trojaner (Gesäubert durch Löschen (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Users\Klaus\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe"

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-10-2014 01

Ran by ***** (administrator) on *****_LAPTOP on 18-10-2014 17:37:04

Running from C:\Users\*****\Downloads

Loaded Profile: ***** (Available profiles: *****)

Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Atheros Commnucations) C:\Windows\System32\AdminService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

(MKS Software Inc.) C:\Windows\System32\nutsrv4.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(PTC) C:\Program Files\PTC\PTC Portmapper\i486_nt\obj\portmap.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGAU.EXE

() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_6.3.9600.20278_x64__8wekyb3d8bbwe\numbers.exe

() C:\Users\*****\AppData\Local\Temp\NOD32E8.tmp
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-10] (ELAN Microelectronics Corp.)

HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\...\Run: [NuTCSetupEnviron] => C:\Program Files\PTC\MKS Toolkit\bin\ncoeenv.exe [37160 2009-11-23] (MKS Software Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-15] (AVAST Software)

HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-835766522-2148508782-3467690004-1001\...\Run: [EPSON BX525WD Series (Kopie 1)] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [166568 2014-07-02] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [146480 2014-07-02] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/software/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin HKCU: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\searchplugins\google-maps.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Cliqz Beta - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\emjgm50o.default-1397678037534\Extensions\cliqz@cliqz.com.xpi [2014-10-15]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-12]
 

Chrome: 

=======
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-19] (AVAST Software)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2013-04-10] (ELAN Microelectronics Corp.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)

R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)

R2 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [563424 2009-11-10] (MKS Software Inc.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)

R2 PortmapperService; C:\Program Files\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [676864 2014-02-02] (PTC) [File not signed]

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

R3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-19] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-19] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-19] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-19] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-19] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-19] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-19] ()

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-20] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)

R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-18 17:37 - 2014-10-18 17:37 - 00014229 _____ () C:\Users\*****\Downloads\FRST.txt

2014-10-18 17:36 - 2014-10-18 17:36 - 00000000 ____D () C:\Users\*****\Downloads\FRST-OlderVersion

2014-10-18 17:35 - 2014-10-18 17:35 - 00854417 _____ () C:\Users\*****\Downloads\SecurityCheck.exe

2014-10-18 12:10 - 2014-10-18 12:10 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe

2014-10-16 20:43 - 2014-10-16 20:43 - 00000936 _____ () C:\Users\*****\Desktop\JRT.txt

2014-10-16 20:37 - 2014-10-16 20:37 - 01705698 _____ (Thisisu) C:\Users\*****\Downloads\JRT(1).exe

2014-10-16 20:25 - 2014-10-16 20:25 - 01976320 _____ () C:\Users\*****\Downloads\AdwCleaner_4.000.exe

2014-10-16 08:55 - 2014-10-16 08:55 - 00000000 ____D () C:\Users\*****\Documents\Fax

2014-10-15 22:49 - 2014-10-15 22:49 - 00380416 _____ () C:\Users\*****\Downloads\Gmer-19357.exe

2014-10-15 22:38 - 2014-10-18 17:30 - 00000000 ____D () C:\Users\*****\Desktop\Trojaner

2014-10-15 22:37 - 2014-10-18 17:37 - 00000000 ____D () C:\FRST

2014-10-15 22:36 - 2014-10-18 17:36 - 02112000 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe

2014-10-15 22:34 - 2014-10-15 22:35 - 00000472 _____ () C:\Users\*****\Downloads\defogger_disable.log

2014-10-15 22:34 - 2014-10-15 22:34 - 00000000 _____ () C:\Users\*****\defogger_reenable

2014-10-15 22:33 - 2014-10-15 22:33 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe

2014-10-15 22:17 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 22:17 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 22:17 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 22:17 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 22:16 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 22:16 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 22:16 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 22:16 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 22:16 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 22:16 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 22:16 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 22:16 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 22:16 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 22:16 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 22:16 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 22:16 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 22:16 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 22:16 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 22:15 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 22:15 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 22:15 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 22:15 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 22:15 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 22:15 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 22:15 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 22:15 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 22:15 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 22:15 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 22:15 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 22:15 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 22:15 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 22:15 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 22:15 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 22:15 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 22:15 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 22:15 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 22:15 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 22:15 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 22:15 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 22:15 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 22:15 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 22:15 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 22:15 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 22:15 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 22:15 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 22:15 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 22:15 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 22:15 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 22:15 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 22:15 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 22:15 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 22:15 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 22:15 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 22:15 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 18:41 - 2014-10-15 18:41 - 00000000 ____D () C:\Users\*****\Downloads\Kunststoff

2014-10-15 18:35 - 2014-10-16 13:47 - 00000000 ____D () C:\Users\*****\Downloads\Heizung

2014-10-15 18:34 - 2014-10-15 18:40 - 00000000 ____D () C:\Users\*****\Downloads\Fotobuch_Addon

2014-10-15 16:38 - 2014-10-17 16:45 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS

2014-10-15 16:38 - 2014-10-15 18:34 - 00000000 ____D () C:\Windows\AutoKMS

2014-10-15 16:30 - 2014-10-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit

2014-10-15 16:24 - 2014-10-15 16:29 - 51553449 _____ () C:\Users\*****\Downloads\mito225.rar

2014-10-15 16:13 - 2014-10-15 16:13 - 00000000 ____D () C:\Users\*****\AppData\Local\SFPC_Auto_Updater

2014-10-15 16:01 - 2014-10-15 16:01 - 00000659 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-10-15 15:58 - 2014-10-18 17:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Developerts LLC USA

2014-10-15 15:58 - 2014-10-15 15:59 - 00000000 ____D () C:\Users\*****\AppData\Roaming\OptimumPcBoost

2014-10-15 15:58 - 2014-10-15 15:58 - 00004014 _____ () C:\Windows\System32\Tasks\Secure Fast PC Auto Updater

2014-10-15 15:58 - 2014-10-15 15:58 - 00003942 _____ () C:\Windows\System32\Tasks\Optimum_Daily

2014-10-15 15:58 - 2014-10-15 15:58 - 00003570 _____ () C:\Windows\System32\Tasks\Secure Fast PC Autorun

2014-10-15 15:58 - 2014-10-15 15:58 - 00003512 _____ () C:\Windows\System32\Tasks\Optimum_LogOn

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft

2014-10-15 15:58 - 2014-10-15 15:58 - 00000000 ____D () C:\Users\*****\AppData\Local\Developerts_LLC

2014-10-15 15:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-10-15 15:12 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-10-15 12:43 - 2014-10-15 14:59 - 00919163 _____ () C:\Users\Public\Documents\trail.txt.40

2014-10-14 23:32 - 2014-10-14 23:36 - 00129256 _____ () C:\Users\Public\Documents\trail.txt.39

2014-10-14 16:44 - 2014-10-14 23:32 - 03430078 _____ () C:\Users\Public\Documents\trail.txt.38

2014-10-14 10:00 - 2014-10-14 13:59 - 01911616 _____ () C:\Users\Public\Documents\trail.txt.37

2014-10-13 21:22 - 2014-10-14 00:56 - 02786659 _____ () C:\Users\Public\Documents\trail.txt.36

2014-10-13 20:44 - 2014-10-13 21:14 - 00319444 _____ () C:\Users\Public\Documents\trail.txt.35

2014-10-13 20:16 - 2014-10-15 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kotflügel

2014-10-13 19:38 - 2014-10-13 20:38 - 00124606 _____ () C:\Users\Public\Documents\trail.txt.34

2014-10-13 19:38 - 2014-10-13 19:38 - 00000000 ____D () C:\Users\*****\AppData\Roaming\NVIDIA

2014-10-13 14:07 - 2014-10-17 17:04 - 00005134 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop

2014-10-12 13:45 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-12 13:45 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-12 13:45 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-12 13:44 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-12 13:44 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-12 13:44 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-12 13:44 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-12 13:44 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-12 13:44 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-12 13:44 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-12 13:44 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-12 13:44 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-12 13:44 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-12 13:44 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-12 13:44 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-12 13:44 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-12 13:44 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-12 13:44 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-12 13:44 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-12 13:44 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-12 13:44 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-12 13:44 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-12 13:44 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-12 13:44 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-12 13:44 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-12 13:44 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-12 13:44 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-12 13:44 - 2014-08-01 01:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieUserList

2014-09-29 21:54 - 2014-09-29 21:54 - 00000000 __SHD () C:\Users\*****\AppData\Local\EmieSiteList

2014-09-26 22:39 - 2014-09-26 22:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-19 19:35 - 2014-10-17 17:11 - 00000000 ____D () C:\Users\*****\Desktop\Bilder_IPHONE
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-18 17:22 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru

2014-10-18 12:29 - 2014-01-26 23:58 - 01763927 _____ () C:\Windows\WindowsUpdate.log

2014-10-17 17:52 - 2014-01-27 00:02 - 01785718 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-17 17:52 - 2013-09-30 05:58 - 00769220 _____ () C:\Windows\system32\perfh007.dat

2014-10-17 17:52 - 2013-09-30 05:58 - 00160448 _____ () C:\Windows\system32\perfc007.dat

2014-10-17 16:43 - 2014-01-27 00:05 - 00000000 ___DO () C:\Users\*****\SkyDrive

2014-10-17 11:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache

2014-10-16 20:34 - 2014-04-11 20:25 - 00000000 ____D () C:\Users\*****\Documents\Mein Steuer-Sparbuch Heute

2014-10-16 20:34 - 2013-09-29 21:05 - 00543778 _____ () C:\Windows\PFRO.log

2014-10-16 20:34 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-16 20:34 - 2013-08-22 16:44 - 00498048 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager

2014-10-16 20:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera

2014-10-16 20:33 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-10-16 20:32 - 2014-04-16 21:27 - 00000000 ____D () C:\AdwCleaner

2014-10-16 20:16 - 2014-04-16 21:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-16 08:42 - 2014-01-27 00:13 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-16 08:42 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-10-16 08:40 - 2014-01-27 00:13 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 23:18 - 2014-01-27 00:09 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-835766522-2148508782-3467690004-1001

2014-10-15 22:34 - 2014-01-27 00:03 - 00000000 ____D () C:\Users\*****

2014-10-15 21:51 - 2014-04-16 21:14 - 00001114 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-15 21:51 - 2014-04-16 21:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-15 18:42 - 2014-09-03 19:58 - 00163840 ___SH () C:\Users\*****\Downloads\Thumbs.db

2014-10-15 16:13 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\tracing

2014-10-15 12:43 - 2014-02-02 22:44 - 00000112 _____ () C:\Users\Public\Documents\std.err

2014-10-15 12:43 - 2014-02-02 22:44 - 00000038 _____ () C:\Users\Public\Documents\std.out

2014-10-13 19:38 - 2014-07-16 13:13 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF

2014-10-13 18:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData

2014-10-12 13:46 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore

2014-10-07 11:07 - 2014-01-27 23:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc

2014-10-07 10:29 - 2013-08-22 16:46 - 00051275 _____ () C:\Windows\setupact.log

2014-10-07 10:16 - 2014-02-16 13:50 - 00042496 ___SH () C:\Users\*****\Desktop\Thumbs.db

2014-09-30 00:45 - 2013-08-22 17:38 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-30 00:45 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-29 21:33 - 2014-01-27 00:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-18 20:45 - 2013-09-30 06:00 - 00000000 ____D () C:\Program Files\Windows Journal

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup

2014-09-18 20:45 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-09-18 20:45 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe
 

Some content of TEMP:

====================

C:\Users\*****\AppData\Local\Temp\52377uninstall.exe

C:\Users\*****\AppData\Local\Temp\AcDeltree.exe

C:\Users\*****\AppData\Local\Temp\amazonicon_v4.exe

C:\Users\*****\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\*****\AppData\Local\Temp\BackupSetup.exe

C:\Users\*****\AppData\Local\Temp\Execute2App.exe

C:\Users\*****\AppData\Local\Temp\FNP_ACT_InstallerCA.dll

C:\Users\*****\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\*****\AppData\Local\Temp\HNK_2010.exe

C:\Users\*****\AppData\Local\Temp\msvcp90.dll

C:\Users\*****\AppData\Local\Temp\msvcr100.dll

C:\Users\*****\AppData\Local\Temp\msvcr90.dll

C:\Users\*****\AppData\Local\Temp\nitro_reader3_64.exe

C:\Users\*****\AppData\Local\Temp\PidGenX.dll

C:\Users\*****\AppData\Local\Temp\pimuninstall.exe

C:\Users\*****\AppData\Local\Temp\Quarantine.exe

C:\Users\*****\AppData\Local\Temp\sdanircmdc.exe

C:\Users\*****\AppData\Local\Temp\sdapskill.exe

C:\Users\*****\AppData\Local\Temp\sdaspwn.exe

C:\Users\*****\AppData\Local\Temp\Sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-13 19:46
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-10-2014 01

Ran by ***** at 2014-10-18 17:37:32

Running from C:\Users\*****\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Creo Thumbnail Viewer 2.0 (HKLM\...\{3F8CCE46-EAFD-4283-9ADB-7025EAC2CF64}) (Version: 30.12.480 - PTC)

Designer 2.0 (HKLM-x32\...\Designer 2.0_is1) (Version: 7.9.6 - Fomanu AG)

EPSON BX525WD Series Printer Uninstall (HKLM\...\EPSON BX525WD Series) (Version:  - SEIKO EPSON Corporation)

ETDWare PS/2-X64 11.6.22.201_WHQL (HKLM\...\Elantech) (Version: 11.6.22.201 - ELAN Microelectronic Corp.)

iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)

Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

MKS Platform Components 9.x (HKLM\...\{30023972-0000-0903-9ABB-000BDB5CF35D}) (Version: 9.3.0000 - Mortice Kern Systems)

Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)

NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)

NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Optimus Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden

NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDF-XChange Editor (HKLM-x32\...\{87738bc6-bdf0-4e55-86b5-32ddece8f51d}) (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.)

PDF-XChange Editor (Version: 5.5.308.2 - Tracker Software Products (Canada) Ltd.) Hidden

Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.)

Samsung Kies3 (x32 Version: 3.2.14034.17 - Samsung Electronics Co., Ltd.) Hidden

SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden

VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)

WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

28-09-2014 10:14:08 Windows Modules Installer

12-10-2014 11:45:06 Windows Update

15-10-2014 14:00:54 Removed Optimum PC Boost
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {24CEFABA-9030-40FB-BFAA-9E04940F6B71} - System32\Tasks\Optimum_LogOn => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {34F2800C-218C-4493-B520-02E7D528467D} - System32\Tasks\Secure Fast PC Auto Updater => C:\Users\*****\AppData\Roaming\Developerts LLC USA\SFPC Auto Updater.exe

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {54563E16-A00B-4B48-A263-DB6B9422D70C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {6388F555-9135-46AF-9F1B-4BAFB6FB0C91} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-10-15] ()

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {6E8769E4-B628-47C0-B468-F349793D9594} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {75DB2D10-5C76-483B-98F9-DB654B2A08EB} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {7EBDCA38-F63D-4DF7-B6B8-D6182402285D} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation

Task: {8677F14A-FF43-4CE0-9EA7-F73DEDD3B8AA} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {9B5D8BD6-5619-4E34-ABC9-6456A17CC707} - System32\Tasks\Optimum_Daily => C:\Program Files (x86)\Optimum PC Boost\OptimumPCBoost.exe

Task: {9DB07B69-CE48-436F-BE9A-FD809EFBA494} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {9EAF8CB8-1FC6-4C8F-8D66-7E95E4BC0BF2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {B5805C99-52AB-4A13-8DF8-98CB3574508A} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv

Task: {B8EEEEDB-BEC3-48D3-8AB1-3E75E328D19C} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics

Task: {BC06FCAF-A24F-4F7E-BA09-F0EE5BE0DC0E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-16] (Microsoft Corporation)

Task: {C0017E72-34E6-454E-BD30-C4974CD6B77A} - System32\Tasks\Microsoft Office 15 Sync Maintenance for *****_LAPTOP-***** *****_Laptop => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {E7B7DC04-38BC-4B75-81FE-F23C12A2E2E6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-19] (AVAST Software)

Task: {EF3F3EE7-C823-4AB9-A716-0BDA67B410DD} - System32\Tasks\Secure Fast PC Autorun => C:\Program Files (x86)\Developerts LLC\Secure Fast PC\Secure Fast PC.exe

Task: {FEC944E4-4B72-4175-B1DB-9C72EEF41725} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
 

==================== Loaded Modules (whitelisted) =============
 

2014-09-12 21:40 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-04-09 21:33 - 2014-07-02 10:13 - 01427736 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe

2014-10-16 20:28 - 2014-10-16 20:28 - 02874368 _____ () C:\Program Files\AVAST Software\Avast\defs\14101601\algo.dll

2014-10-18 16:23 - 2014-10-18 16:23 - 02896384 _____ () C:\Program Files\AVAST Software\Avast\defs\14101800\algo.dll

2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 09789208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wgui14.dll

2014-04-09 21:32 - 2014-07-02 10:14 - 03880216 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wcore14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00035608 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsdcom48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00322840 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsguiwinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00309016 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rscorewinapi48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02738456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfvie14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 01043456 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-core.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00250368 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-contribs-lib.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 00136472 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\rsodbc48.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 02116376 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wsteu14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01932568 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wreli14.dll

2014-04-09 21:32 - 2014-02-11 11:53 - 00094720 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\clucene-shared.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 04326168 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wauff14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01564952 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 05291288 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01698584 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01809688 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae314.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01627928 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wbae414.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01117976 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau114.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01341208 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\whau214.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01309464 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wwerb14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 07340824 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wkont14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01286936 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wimp14.dll

2014-04-09 21:32 - 2014-07-02 10:13 - 01331480 _____ () C:\Program Files (x86)\WISO\Steuersoftware 2014\wfabu14.dll

2014-04-12 13:48 - 2014-04-12 13:48 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-09-26 22:39 - 2014-09-26 22:39 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\*****\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

HKLM\...\StartupApproved\Run: => "HotKeysCmds"

HKLM\...\StartupApproved\Run: => "IgfxTray"

HKLM\...\StartupApproved\Run: => "Persistence"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-835766522-2148508782-3467690004-500 - Administrator - Disabled)

Gast (S-1-5-21-835766522-2148508782-3467690004-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-835766522-2148508782-3467690004-1003 - Limited - Enabled)

***** (S-1-5-21-835766522-2148508782-3467690004-1001 - Administrator - Enabled) => C:\Users\*****
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/18/2014 05:36:44 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/18/2014 05:33:34 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/18/2014 00:12:02 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/18/2014 00:12:01 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/18/2014 00:11:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/18/2014 00:11:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
 

Error: (10/16/2014 09:21:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: *****_LAPTOP)

Description: Bei der Aktivierung der App „Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 
 

System errors:

=============

Error: (10/18/2014 05:22:52 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/18/2014 03:53:53 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/18/2014 02:40:35 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/18/2014 00:40:46 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/17/2014 09:03:26 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/17/2014 05:24:46 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/17/2014 01:31:55 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/17/2014 00:45:04 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
 

Error: (10/16/2014 11:06:18 PM) (Source: DCOM) (EventID: 10010) (User: *****_LAPTOP)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (10/16/2014 10:38:27 PM) (Source: DCOM) (EventID: 10010) (User: *****_LAPTOP)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 
 

Microsoft Office Sessions:

=========================

Error: (10/18/2014 05:36:44 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
 

Error: (10/18/2014 05:33:34 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (10/18/2014 00:12:02 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
 

Error: (10/18/2014 00:12:01 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
 

Error: (10/18/2014 00:11:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
 

Error: (10/18/2014 00:11:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
 

Error: (10/16/2014 09:21:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: *****_LAPTOP)

Description: Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader-2144927151
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-19 22:49:34.167

  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz

Percentage of memory in use: 23%

Total physical RAM: 8076.36 MB

Available physical RAM: 6153.81 MB

Total Pagefile: 9356.36 MB

Available Pagefile: 7347.8 MB

Total Virtual: 131072 MB

Available Virtual: 131071.83 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:111.79 GB) (Free:43.87 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (Volume) (Fixed) (Total:465.67 GB) (Free:405.74 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 285EB630)

Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Während dem ESET Scan kam wieder der Warnhinweis (siehe Anhang)!

ESET hat ein paar Bedrohungen gefunden und diese auch gelöscht. Mal sehen wie sich das System in Zukunft verhält.

Muss ich noch etwas unternehmen? Wie schätzt du die Situation ein?

Danke!

Das waren nur Tempfiles. Noch Probleme mit dem REchner?

Hallo,

war auf Dienstreise.

Bis jetzt keine Probleme mit dem Rechner.

Vielen Dank für die Hilfe.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.