GVU Trojaner auf Windows 8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-07-2013 01
Ran by SYSTEM on 13-07-2013 21:11:33
Running from D:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO  [1214608 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [BtPreLoad] - "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe" [64640 2012-08-13] ()
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-21] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [68776 2012-08-18] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 [156000 2012-10-04] (Intel Corporation)
HKLM-x32\...\Run: [Intel AppUp(R) center] - "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 [156000 2012-10-04] (Intel Corporation)
HKLM-x32\...\Run: [WinampAgent] - "C:\Program Files (x86)\Winamp\winampa.exe" [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073352 2012-06-25] (Adobe Systems Incorporated)
HKU\Pavi\...\Run: [AdobeBridge] -  [x]
HKU\Pavi\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Pavi\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-04-05] ()
HKU\Pavi\...\Run: [GoogleDriveSync] - "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
HKU\Pavi\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Pavi\AppData\Local\Temp\rlyhlvieqsalhjled.exe [43008 2013-07-13] (NVIDIA Corporation) <===== ATTENTION
HKU\Pavi\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION 
HKU\Pavi\...\Command Processor: "C:\Users\Pavi\AppData\Local\Temp\rlyhlvieqsalhjled.exe" <===== ATTENTION!
AppInit_DLLs-x32: c:\progra~3\browse~1\261249~1.132\{c16c1~1\browse~1.dll  [2520016 2013-03-22] ()
Startup: C:\Users\Pavi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

==================== Services (Whitelisted) =================

S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-13] (Qualcomm Atheros Commnucations)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-08-06] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-08-06] (Intel Corporation)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-08-18] (Sony Corporation)
S2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1359408 2013-03-26] (Sony Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
S2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)
S2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-13] (Atheros)
S4 McOobeSv2; "C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc [x]

==================== Drivers (Whitelisted) ====================

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-08-20] (Advanced Micro Devices)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-13] (Qualcomm Atheros)
S3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-08-13] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-21] (Synaptics Incorporated)
S3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-13 21:11 - 2013-07-13 21:11 - 00000000 ____D C:\FRST
2013-07-13 19:20 - 2013-07-13 19:20 - 00163033 _____ C:\Users\Pavi\AppData\Local\2433f433
2013-07-13 19:20 - 2013-07-13 19:20 - 00163008 _____ C:\ProgramData\2433f433
2013-07-13 19:20 - 2013-07-13 19:20 - 00162995 _____ C:\Users\Pavi\AppData\Roaming\2433f433
2013-07-13 16:13 - 2013-07-13 16:13 - 00000000 ____D C:\Users\Pavi\Documents\Amazon MP3
2013-07-06 17:41 - 2013-07-06 17:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-06 09:52 - 2013-07-06 09:53 - 00000000 ____D 
2013-06-26 20:28 - 2013-06-26 20:29 - 05107536 _____ C:\Windows\System32\FNTCACHE.DAT
2013-06-26 19:38 - 2013-05-04 07:59 - 13644288 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Xaml.dll
2013-06-26 19:38 - 2013-05-04 07:59 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2013-06-26 19:38 - 2013-05-04 07:59 - 01483776 _____ (Microsoft Corporation) C:\Windows\System32\VSSVC.exe
2013-06-26 19:38 - 2013-05-04 07:59 - 00760320 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2013-06-26 19:38 - 2013-05-04 07:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll
2013-06-26 19:38 - 2013-05-04 07:58 - 01332736 _____ (Microsoft Corporation) C:\Windows\System32\sysmain.dll
2013-06-26 19:38 - 2013-05-04 07:58 - 00470528 _____ (Microsoft Corporation) C:\Windows\System32\netprofmsvc.dll
2013-06-26 19:38 - 2013-05-04 07:57 - 02305024 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-06-26 19:38 - 2013-05-04 07:57 - 01131520 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentServer.dll
2013-06-26 19:38 - 2013-05-04 05:57 - 10788864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2013-06-26 19:38 - 2013-05-04 05:57 - 08857088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2013-06-26 19:38 - 2013-05-04 05:47 - 00427520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdbss.sys
2013-06-26 19:37 - 2013-05-04 08:58 - 00120736 _____ (Microsoft Corporation) C:\Windows\System32\AuthHost.exe
2013-06-26 19:37 - 2013-05-04 08:34 - 00446720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\USBHUB3.SYS
2013-06-26 19:37 - 2013-05-04 08:34 - 00284416 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\spaceport.sys
2013-06-26 19:37 - 2013-05-04 08:34 - 00213248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\UCX01000.SYS
2013-06-26 19:37 - 2013-05-04 08:30 - 00058312 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2013-06-26 19:37 - 2013-05-04 07:59 - 01619968 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2013-06-26 19:37 - 2013-05-04 07:59 - 00812544 _____ (Microsoft Corporation) C:\Windows\System32\Magnify.exe
2013-06-26 19:37 - 2013-05-04 07:59 - 00251904 _____ (Microsoft Corporation) C:\Windows\System32\WUSettingsProvider.dll
2013-06-26 19:37 - 2013-05-04 07:59 - 00141824 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2013-06-26 19:37 - 2013-05-04 07:59 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2013-06-26 19:37 - 2013-05-04 07:59 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2013-06-26 19:37 - 2013-05-04 07:58 - 00330240 _____ (Microsoft Corporation) C:\Windows\System32\stobject.dll
2013-06-26 19:37 - 2013-05-04 07:58 - 00328192 _____ (Microsoft Corporation) C:\Windows\System32\ubpm.dll
2013-06-26 19:37 - 2013-05-04 07:58 - 00173568 _____ (Microsoft Corporation) C:\Windows\System32\storewuauth.dll
2013-06-26 19:37 - 2013-05-04 07:58 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\netplwiz.dll
2013-06-26 19:37 - 2013-05-04 07:58 - 00151552 _____ (Microsoft Corporation) C:\Windows\System32\netprofm.dll
2013-06-26 19:37 - 2013-05-04 07:58 - 00093696 _____ (Microsoft Corporation) C:\Windows\System32\psmsrv.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00708096 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentExtensions.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00560640 _____ (Microsoft Corporation) C:\Windows\System32\mfmp4srcsnk.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00501760 _____ (Microsoft Corporation) C:\Windows\System32\DevicePairing.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\System32\BCP47Langs.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00179712 _____ (Microsoft Corporation) C:\Windows\System32\bisrv.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00122368 _____ (Microsoft Corporation) C:\Windows\System32\biwinrt.dll
2013-06-26 19:37 - 2013-05-04 07:57 - 00017408 _____ (Microsoft Corporation) C:\Windows\System32\muifontsetup.dll
2013-06-26 19:37 - 2013-05-04 07:56 - 00419840 _____ (Microsoft Corporation) C:\Windows\System32\intl.cpl
2013-06-26 19:37 - 2013-05-04 05:58 - 00758784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Magnify.exe
2013-06-26 19:37 - 2013-05-04 05:58 - 00621056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-06-26 19:37 - 2013-05-04 05:58 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-06-26 19:37 - 2013-05-04 05:58 - 00083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-06-26 19:37 - 2013-05-04 05:58 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-06-26 19:37 - 2013-05-04 05:57 - 00303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-06-26 19:37 - 2013-05-04 05:57 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2013-06-26 19:37 - 2013-05-04 05:57 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2013-06-26 19:37 - 2013-05-04 05:57 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netprofm.dll
2013-06-26 19:37 - 2013-05-04 05:57 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\npmproxy.dll
2013-06-26 19:37 - 2013-05-04 05:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2013-06-26 19:37 - 2013-05-04 05:56 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-06-26 19:37 - 2013-05-04 05:56 - 00449536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2013-06-26 19:37 - 2013-05-04 05:56 - 00411136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2013-06-26 19:37 - 2013-05-04 05:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BCP47Langs.dll
2013-06-26 19:37 - 2013-05-04 05:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\biwinrt.dll
2013-06-26 19:37 - 2013-05-04 05:55 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2013-06-26 19:37 - 2013-05-04 05:51 - 00014848 _____ (Microsoft) C:\Windows\System32\rars.rs
2013-06-26 19:37 - 2013-05-04 05:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidclass.sys
2013-06-26 19:37 - 2013-05-04 05:48 - 00027648 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidusb.sys
2013-06-26 19:37 - 2013-05-04 05:10 - 00014848 _____ (Microsoft) C:\Windows\SysWOW64\rars.rs
2013-06-26 19:37 - 2013-05-02 23:04 - 00386646 _____ C:\Windows\System32\ApnDatabase.xml
2013-06-26 19:36 - 2013-05-31 00:24 - 01257472 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-06-26 19:36 - 2013-05-31 00:08 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-06-26 19:36 - 2013-05-24 00:01 - 01300992 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-06-26 19:36 - 2013-05-23 23:27 - 01022464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-06-26 19:36 - 2013-05-15 23:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\System32\tssdisai.dll
2013-06-26 19:36 - 2013-05-15 03:25 - 00888320 _____ (Microsoft Corporation) C:\Windows\System32\autochk.exe
2013-06-26 19:36 - 2013-05-15 03:25 - 00542208 _____ (Microsoft Corporation) C:\Windows\System32\untfs.dll
2013-06-26 19:36 - 2013-05-15 03:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2013-06-26 19:36 - 2013-05-15 03:24 - 00482816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2013-06-26 19:36 - 2013-05-04 08:45 - 02233600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-26 19:36 - 2013-04-27 06:20 - 00733184 _____ (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-26 19:36 - 2013-04-24 00:13 - 01013248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-26 19:36 - 2013-04-24 00:12 - 01569792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-26 19:36 - 2013-04-24 00:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-26 19:36 - 2013-04-23 23:56 - 01255936 _____ (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-26 19:36 - 2013-04-23 23:55 - 01889280 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-26 19:36 - 2013-04-23 23:55 - 00141312 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-26 19:36 - 2013-04-23 23:55 - 00068096 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-26 19:35 - 2013-04-03 00:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-26 19:35 - 2013-04-03 00:12 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-25 11:03 - 2013-06-25 11:03 - 00000000 ____D C:\Users\Pavi\AppData\Local\Daedalic Entertainment
2013-06-25 10:49 - 2013-06-25 10:49 - 00000000 ____D C:\Program Files (x86)\GOG.com
2013-06-25 10:42 - 2013-06-25 10:42 - 00001557 _____ C:\Users\Public\Desktop\Deponia.lnk
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default\AppData\LocalGoogle
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default User\AppData\LocalGoogle
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2013-06-13 17:34 - 2013-06-13 17:41 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2940544721-4246715374-431631000-1004
2013-06-13 17:34 - 2013-06-13 17:34 - 00002034 _____ C:\Users\Gast1\Desktop\Opera.lnk
2013-06-13 17:34 - 2013-06-13 17:34 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Opera
2013-06-13 17:34 - 2013-06-13 17:34 - 00000000 ____D C:\Users\Gast1\AppData\Local\Opera
2013-06-13 17:32 - 2013-06-13 17:32 - 00000000 ____D C:\Users\Gast1\AppData\Local\Sony Corporation
2013-06-13 17:31 - 2013-06-13 17:31 - 00000000 ____D C:\Users\Gast1\AppData\LocalGoogle
2013-06-13 17:30 - 2013-06-13 17:30 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\ATI
2013-06-13 17:30 - 2013-06-13 17:30 - 00000000 ____D C:\Users\Gast1\AppData\Local\ATI
2013-06-13 17:29 - 2013-06-13 17:31 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Sony Corporation
2013-06-13 17:29 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Local\Power2Go8
2013-06-13 17:29 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Local\Adobe
2013-06-13 17:28 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Adobe
2013-06-13 17:27 - 2013-06-13 17:28 - 00000000 ____D C:\Users\Gast1\AppData\Local\Packages
2013-06-13 17:27 - 2013-06-13 17:28 - 00000000 ____D C:\users\Gast1
2013-06-13 17:27 - 2013-06-13 17:27 - 00000020 ___SH C:\Users\Gast1\ntuser.ini
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Vorlagen
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Startmenü
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Netzwerkumgebung
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Lokale Einstellungen
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Eigene Dateien
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Druckumgebung
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Documents\Eigene Musik
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Documents\Eigene Bilder
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\AppData\Local\Verlauf
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\AppData\Local\Anwendungsdaten
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Anwendungsdaten
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\WTablet
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 ____D C:\Users\Gast1\AppData\Local\VirtualStore
2013-06-13 17:27 - 2013-03-31 11:25 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Macromedia

==================== One Month Modified Files and Folders =======

2013-07-13 21:11 - 2013-07-13 21:11 - 00000000 ____D C:\FRST
2013-07-13 20:09 - 2012-11-03 07:36 - 01625848 _____ C:\Windows\WindowsUpdate.log
2013-07-13 20:08 - 2013-05-27 14:28 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-13 20:08 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-13 20:04 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-07-13 20:03 - 2012-08-03 03:22 - 00016026 _____ C:\Windows\PFRO.log
2013-07-13 19:20 - 2013-07-13 19:20 - 00163033 _____ C:\Users\Pavi\AppData\Local\2433f433
2013-07-13 19:20 - 2013-07-13 19:20 - 00163008 _____ C:\ProgramData\2433f433
2013-07-13 19:20 - 2013-07-13 19:20 - 00162995 _____ C:\Users\Pavi\AppData\Roaming\2433f433
2013-07-13 19:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\System32\sru
2013-07-13 18:43 - 2013-05-27 14:28 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 16:34 - 2013-03-18 18:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-13 16:14 - 2013-03-18 16:01 - 00000000 ___RD C:\Users\Pavi\Dropbox
2013-07-13 16:14 - 2013-03-18 15:56 - 00000000 ____D C:\Users\Pavi\AppData\Roaming\Dropbox
2013-07-13 16:13 - 2013-07-13 16:13 - 00000000 ____D C:\Users\Pavi\Documents\Amazon MP3
2013-07-13 16:13 - 2013-05-27 14:29 - 00000000 ___SD C:\Users\Pavi\Google Drive
2013-07-13 14:48 - 2013-03-18 15:15 - 00000000 ____D C:\users\Pavi
2013-07-13 14:46 - 2013-03-18 16:14 - 00000000 ____D C:\Users\Pavi\AppData\Local\Last.fm
2013-07-13 14:30 - 2013-04-22 14:48 - 00364032 ___SH C:\Users\Pavi\Thumbs.db
2013-07-13 14:23 - 2013-03-18 16:47 - 00000000 ____D C:\Users\Pavi\AppData\Roaming\uTorrent
2013-07-13 14:10 - 2013-03-18 15:56 - 00000000 ___RD C:\Users\Pavi\Documents\Blog
2013-07-13 13:41 - 2013-03-18 16:10 - 00000000 ____D C:\Users\Pavi\AppData\Roaming\Winamp
2013-07-13 11:17 - 2013-03-31 10:09 - 00000000 ____D C:\Users\Pavi\AppData\Roaming\Skype
2013-07-13 09:38 - 2013-05-27 14:28 - 00004100 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 09:38 - 2013-05-27 14:28 - 00003864 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-13 09:27 - 2013-03-20 17:33 - 00000000 ____D C:\Users\Pavi\AppData\Local\Adobe
2013-07-09 09:04 - 2013-03-19 12:02 - 02861056 ___SH C:\Users\Pavi\Downloads\Thumbs.db
2013-07-09 08:53 - 2012-11-03 07:11 - 00753134 _____ C:\Windows\System32\perfh007.dat
2013-07-09 08:53 - 2012-11-03 07:11 - 00155826 _____ C:\Windows\System32\perfc007.dat
2013-07-09 08:53 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-07 10:43 - 2013-05-26 14:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-07 10:31 - 2013-03-18 15:26 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-06 09:50 - 2013-03-18 15:26 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2940544721-4246715374-431631000-1001
2013-07-05 19:57 - 2013-04-15 11:11 - 00001456 _____ C:\Users\Pavi\AppData\Local\Adobe Save for Web 13.0 Prefs
2013-07-05 19:51 - 2013-03-18 15:53 - 00004164 _____ C:\Users\Pavi\Desktop\Notizen.txt
2013-06-30 19:14 - 2013-03-24 14:32 - 00000000 ____D C:\Users\Pavi\AppData\Roaming\vlc
2013-06-26 20:54 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-06-26 20:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-06-26 20:30 - 2013-03-20 17:32 - 00000000 ____D C:\Users\Pavi\AppData\Local\CrashDumps
2013-06-26 20:29 - 2013-06-26 20:28 - 05107536 _____ C:\Windows\System32\FNTCACHE.DAT
2013-06-26 20:27 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\servicing
2013-06-26 20:23 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-06-26 20:23 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-06-26 20:23 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-06-26 20:23 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-06-26 20:23 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-06-26 20:23 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\Dism
2013-06-25 11:03 - 2013-06-25 11:03 - 00000000 ____D C:\Users\Pavi\AppData\Local\Daedalic Entertainment
2013-06-25 10:49 - 2013-06-25 10:49 - 00000000 ____D C:\Program Files (x86)\GOG.com
2013-06-25 10:42 - 2013-06-25 10:42 - 00001557 _____ C:\Users\Public\Desktop\Deponia.lnk
2013-06-25 10:38 - 2013-03-18 18:25 - 00000000 ____D C:\Spiele
2013-06-24 09:43 - 2013-03-18 16:52 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default\AppData\LocalGoogle
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default User\AppData\LocalGoogle
2013-06-24 08:33 - 2013-06-24 08:33 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2013-06-16 20:01 - 2013-04-21 08:58 - 00000000 ____D C:\Update
2013-06-16 10:17 - 2012-11-03 07:18 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-06-13 17:41 - 2013-06-13 17:34 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2940544721-4246715374-431631000-1004
2013-06-13 17:34 - 2013-06-13 17:34 - 00002034 _____ C:\Users\Gast1\Desktop\Opera.lnk
2013-06-13 17:34 - 2013-06-13 17:34 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Opera
2013-06-13 17:34 - 2013-06-13 17:34 - 00000000 ____D C:\Users\Gast1\AppData\Local\Opera
2013-06-13 17:32 - 2013-06-13 17:32 - 00000000 ____D C:\Users\Gast1\AppData\Local\Sony Corporation
2013-06-13 17:31 - 2013-06-13 17:31 - 00000000 ____D C:\Users\Gast1\AppData\LocalGoogle
2013-06-13 17:31 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Sony Corporation
2013-06-13 17:30 - 2013-06-13 17:30 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\ATI
2013-06-13 17:30 - 2013-06-13 17:30 - 00000000 ____D C:\Users\Gast1\AppData\Local\ATI
2013-06-13 17:29 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Local\Power2Go8
2013-06-13 17:29 - 2013-06-13 17:29 - 00000000 ____D C:\Users\Gast1\AppData\Local\Adobe
2013-06-13 17:29 - 2013-06-13 17:28 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\Adobe
2013-06-13 17:28 - 2013-06-13 17:27 - 00000000 ____D C:\Users\Gast1\AppData\Local\Packages
2013-06-13 17:28 - 2013-06-13 17:27 - 00000000 ____D C:\users\Gast1
2013-06-13 17:27 - 2013-06-13 17:27 - 00000020 ___SH C:\Users\Gast1\ntuser.ini
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Vorlagen
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Startmenü
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Netzwerkumgebung
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Lokale Einstellungen
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Eigene Dateien
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Druckumgebung
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Documents\Eigene Musik
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Documents\Eigene Bilder
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\AppData\Local\Verlauf
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\AppData\Local\Anwendungsdaten
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 __SHD C:\Users\Gast1\Anwendungsdaten
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 ____D C:\Users\Gast1\AppData\Roaming\WTablet
2013-06-13 17:27 - 2013-06-13 17:27 - 00000000 ____D C:\Users\Gast1\AppData\Local\VirtualStore

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-03 20:18:57
Restore point made on: 2013-07-13 11:00:31

==================== Memory info =========================== 

Percentage of memory in use: 12%
Total physical RAM: 6091.27 MB
Available physical RAM: 5322.48 MB
Total Pagefile: 6091.27 MB
Available Pagefile: 5346.15 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:566.31 GB) (Free:329.49 GB) NTFS
Drive d: (STORE N GO) (Removable) (Total:3.72 GB) (Free:0.94 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596 GB) (Disk ID: A866F9E4)

Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 4EFA7722)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0C)


LastRegBack: 2013-07-12 09:04

==================== End Of Log ============================