Windows-8-PC mit Systemabsturz und temporärem Startproblem

SuNi67 · 13.08.2013, 15:39

Guten Tag liebe Trojaner-Board-Helfer,

unser Zweit-PC verhält sich seit gestern zeitweilig recht seltsam. Gestern wollte mein Mann nach dem Systemstart ein Programm starten, woraufhin der Bildschirm schwarz wurde und nur noch ein Meldung zeigte, dass ein schwerer Windows-Fehler vorläge und man von einem funktionstüchtgen Systemdatenträger neu booten solle. Vor Schreck hat er dann den PC einfach ausgemacht und neu hochgefahren. Funktionierte auch wieder prima. quickscan mit Mbam ergab keinen Fund.
Zwischenzeitlich wurde der PC noch ein paarmal ohne Probleme benutzt - Vor 2 Stunden hab ich dann den Startknopf des PCs gedrückt, der dann aber nicht startete sondern lediglich einen weißen Mauszeiger auf schwarzem Grund zeigte. - Kein Startbildschirm, kein Willkommensbildschirm und schon gar keine Anmeldung.

Habe also das Ding wieder ausgeschaltet, vom Strom getrennt und wieder neu gestartet - und siehe, da er funktioniert wieder. Vollscan mit Avast Free gemacht - Kein Fund!
Daraufhin habe ich noch die von euch gewünschten Scans mit defogger, Frst und GMER gemacht.

Bei GMER hat er ein paar Mal gemäkelt:
Direkt nach gmer-Start: C:\windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird
gleiche Meldung während des scans bei Sektor C:\users\sanne\Downloads \gmer_2.1.19163.exe[3480]@c:\windows\system32\OLEAUT32.dll
und so ziemlich am Scan-Ende kam die Meldung C:\User\sanne\ntuser.dat Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird

So, ich hoffe, ich habe nichts vergessen und wäre Euch unendlich dankbar, wenn Ihr Euch die Logs einmal anschauen würdet, ob da irgendwas bösartiges zu finden ist

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:48 on 13/08/2013 (Sanne)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013
Ran by Sanne (administrator) on 13-08-2013 15:50:00
Running from C:\Users\Sanne\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] -  [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL [759384 2013-07-08] ()
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll [759384 2013-07-08] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKCU - DefaultScope {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-07-21 21:06 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:58 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 15:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-20 15:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:43 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-13 15:43 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-13 15:43 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:40 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 15:39 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 15:38 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 15:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 15:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-13 14:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 13:30 - 2012-11-29 12:05 - 01170115 _____ C:\Windows\WindowsUpdate.log
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 22:16 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:26 - 2013-03-14 11:32 - 00002450 _____ C:\Windows\Sandboxie.ini
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:38 - 2012-08-28 13:13 - 00163234 _____ C:\Windows\PFRO.log
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 21:06 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 11:50

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2013
Ran by Sanne at 2013-08-13 15:50:27
Running from C:\Users\Sanne\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
7-Zip 9.20 (x32)
Adobe Digital Editions 2.0 (x32 Version: 2.0)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Ashampoo AppLauncher (Medion) v.1.0.0 (x32 Version: 1.0.0)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3111_44883)
CyberLink PhotoDirector 3 (x32 Version: 3.0.3124)
CyberLink PhotoNow (x32 Version: 1.1.7717)
CyberLink Power2Go 8 (x32 Version: 8.0.0.1920)
CyberLink PowerDirector (Version: 9.0.0.3815c)
CyberLink PowerDVD 10 (x32 Version: 10.0.4125.02)
CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.2715b)
CyberLink PowerRecover (Version: 5.7.0.0906)
CyberLink PowerRecover (x32 Version: 5.7.0.0906)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
DIE SIEDLER - Das Erbe der Könige - Gold Edition (x32 Version: 1.00.0000)
Fiesta Online DE 1.04.095 (x32 Version: 1.04.095)
FileHippo.com Update Checker (x32)
Fotogalerie (x32 Version: 16.4.3503.0728)
Fotogalerija (x32 Version: 16.4.3503.0728)
Fotogalleri (x32 Version: 16.4.3503.0728)
Fotogalleriet (x32 Version: 16.4.3503.0728)
Fotoğraf Galerisi (x32 Version: 16.4.3503.0728)
Fotótár (x32 Version: 16.4.3503.0728)
Galeria de Fotografias (x32 Version: 16.4.3503.0728)
Galería de fotos (x32 Version: 16.4.3503.0728)
Galeria fotografii (x32 Version: 16.4.3503.0728)
Galerie de photos (x32 Version: 16.4.3503.0728)
Google Chrome (x32 Version: 28.0.1500.95)
Google Update Helper (x32 Version: 1.3.21.153)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1281)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.4.1001)
Intel® Trusted Connect Service Client (Version: 1.24.738.1)
League of Legends (x32 Version: 1.3)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mediathek (x32 Version: 1.4.0)
Medion Home Cinema 10 (x32 Version: 10.0)
Medion Home Cinema 10 (x32 Version: 10.1924)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 23.0 (x86 de) (x32 Version: 23.0)
Mozilla Maintenance Service (x32 Version: 17.0.8)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
NVIDIA 3D Vision Controller-Treiber 314.07 (Version: 314.07)
NVIDIA 3D Vision Treiber 314.07 (Version: 314.07)
NVIDIA Grafiktreiber 314.07 (Version: 314.07)
NVIDIA HD-Audiotreiber 1.3.23.1 (Version: 1.3.23.1)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1407)
NVIDIA Systemsteuerung 314.07 (Version: 314.07)
NVIDIA Update 1.12.12 (Version: 1.12.12)
NVIDIA Update Components (Version: 1.12.12)
Pando Media Booster (x32 Version: 2.6.0.8)
Photo Common (x32 Version: 16.4.3503.0728)
Photo Gallery (x32 Version: 16.4.3503.0728)
Podstawowe programy Windows Live (x32 Version: 16.4.3503.0728)
QuickLaunch (x32 Version: 1.00.0019)
Raccolta foto (x32 Version: 16.4.3503.0728)
Reader for PC (x32 Version: 2.0.02.15180)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6710)
Sandboxie 4.04 (64-bit) (Version: 4.04)
Secunia PSI (3.0.0.6005) (x32 Version: 3.0.0.6005)
Secure Banking Version 1.5.1 (x32 Version: 1.5.1)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
Skype™ 6.7 (x32 Version: 6.7.102)
Stronghold 2 (x32 Version: 1.40.1000)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Windows Live (x32 Version: 16.4.3503.0728)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live Temel Parçalar (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Worx 5.2.9
Συλλογή φωτογραφιών (x32 Version: 16.4.3503.0728)

==================== Restore Points  =========================

28-07-2013 10:32:53 Windows Update
11-08-2013 14:04:39 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation)
Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical
Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents
Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance
Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh
Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks
Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update
Task: {30FFF6E4-FAB3-4B7F-B4A8-AD0D7E73A529} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1003 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {349EA0C3-8CAB-4B08-8D73-3A0D82CBD554} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator
Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask
Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance
Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage
Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation)
Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon
Task: {4F1D2AE7-1069-46FA-9457-53A2CCAEFE92} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1008 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance
Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required
Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation)
Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation)
Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319
Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update
Task: {77DD17B7-3F1A-401C-B40D-3718D24C2CF4} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect
Task: {7A23DED5-0D43-4C22-ABAB-568C017EDE40} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1003
Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance
Task: {81762FBB-0464-4396-A6E5-4602F39C3CBC} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation)
Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance
Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode)
Task: {8EC9F6B1-67D5-4658-9E1A-4E8289B0E760} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1007 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {901A0531-78F7-4B09-A7E5-5959A6C7F5CD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses
Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime
Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64
Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask
Task: {AB289308-A5D6-43CE-9449-016AB0332E3F} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup
Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh
Task: {AC221D7B-E624-4F18-9671-369646ADCA38} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall
Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask
Task: {AD021103-C0F3-45F4-B707-180DFD69782D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-20] (Adobe Systems Incorporated)
Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask
Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan
Task: {B1277EC7-70CD-41A4-8D37-A94F9FAC8752} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: {B151B483-01FD-44B2-83E3-9AF0254E61F3} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1008
Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific
Task: {BCF9560B-3A82-476A-9148-87249A19F82A} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-500
Task: {BF3E6C21-FDAB-4A55-A481-4FB76127DACB} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation)
Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan
Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork
Task: {D5C2E41C-C889-45D7-A357-23386F57A207} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1007
Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical
Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery
Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation)
Task: {EB66C230-1811-4263-97B6-5D14FDC3CDFA} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1006 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {EBA33922-91B8-48FA-BBCC-8388AD87766D} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1006
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation)
Task: {EC552CC1-91E5-4FC2-9A3C-DCAEED992A81} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM
Task: {F3A236AB-4E73-44B2-8718-486A2D793D45} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/13/2013 03:34:48 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 23.0.0.4959 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 8a8

Startzeit: 01ce98292c428806

Endzeit: 47

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: fe40c736-041c-11e3-bf05-d43d7e2e172b

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (08/12/2013 08:40:13 PM) (Source: Application Hang) (User: )
Description: Programm Fiesta.bin, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 974

Startzeit: 01ce978b54870240

Endzeit: 32

Anwendungspfad: C:\gamigo\FIESTA~1\Fiesta.bin

Berichts-ID: 9a5c4ae5-037e-11e3-bf02-d43d7e2e172b

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (08/12/2013 07:23:53 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000003811c
ID des fehlerhaften Prozesses: 0x324
Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0
Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1
Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2
Berichtskennung: LenovoQuickLaunch.exe3
Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5

Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager) (User: )
Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt.

Error: (07/04/2013 11:54:49 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000003811c
ID des fehlerhaften Prozesses: 0x5c4
Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0
Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1
Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2
Berichtskennung: LenovoQuickLaunch.exe3
Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5

Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime) (User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 11:54:37 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000003811c
ID des fehlerhaften Prozesses: 0x11a0
Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0
Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1
Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2
Berichtskennung: LenovoQuickLaunch.exe3
Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5

Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime) (User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 11:53:58 AM) (Source: Application Hang) (User: )
Description: Programm psi.exe, Version 3.0.0.6005 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 12dc

Startzeit: 01ce789c52f11484

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\Secunia\PSI\psi.exe

Berichts-ID: a176d318-e48f-11e2-bef3-801f02803614

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (08/13/2013 03:38:58 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (08/13/2013 03:38:40 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (08/13/2013 02:46:24 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (08/13/2013 02:46:06 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0xc000014d0

Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (08/13/2013 03:34:48 PM) (Source: Application Hang)(User: )
Description: firefox.exe23.0.0.49598a801ce98292c42880647C:\Program Files (x86)\Mozilla Firefox\firefox.exefe40c736-041c-11e3-bf05-d43d7e2e172b

Error: (08/12/2013 08:40:13 PM) (Source: Application Hang)(User: )
Description: Fiesta.bin0.0.0.097401ce978b5487024032C:\gamigo\FIESTA~1\Fiesta.bin9a5c4ae5-037e-11e3-bf02-d43d7e2e172b

Error: (08/12/2013 07:23:53 PM) (Source: Application Error)(User: )
Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c32401ce9780b17f17faC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllf5b7cb99-0373-11e3-bf01-801f02803614

Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager)(User: )
Description: 0x8898008d

Error: (07/04/2013 11:54:49 AM) (Source: Application Error)(User: )
Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c5c401ce789c844d8ae6C:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllc37de74b-e48f-11e2-bef3-801f02803614

Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime)(User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 11:54:37 AM) (Source: Application Error)(User: )
Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c11a001ce789c6f90083aC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllbc6ba0f7-e48f-11e2-bef3-801f02803614

Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime)(User: )
Description: Anwendung: LenovoQuickLaunch.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NotSupportedException
Stapel:
   bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean)
   bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean)
   bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean)
   bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean)
   bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean)
   bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption)
   bei Lenovo.WPF.StartMenu.Logger.MonitorLog()
   bei Lenovo.WPF.StartMenu.Logger.WriteLog()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/04/2013 11:53:58 AM) (Source: Application Hang)(User: )
Description: psi.exe3.0.0.600512dc01ce789c52f1148416C:\Program Files (x86)\Secunia\PSI\psi.exea176d318-e48f-11e2-bef3-801f02803614


==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 4037.83 MB
Available physical RAM: 2961.18 MB
Total Pagefile: 8133.83 MB
Available Pagefile: 6964.02 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:1801.3 GB) (Free:1728.11 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type
==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-13 16:02:33
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000035 ST2000DM001-9YN164 rev.CC4G 1863,02GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Sanne\AppData\Local\Temp\uwtoypog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163                                 000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\wininit.exe[664] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\services.exe[736] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\lsass.exe[772] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                 000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[876] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\nvvsvc.exe[932] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                                000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\System32\svchost.exe[328] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[560] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[580] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\System32\svchost.exe[1068] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\Sandboxie\SbieSvc.exe[1212] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                       000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1356] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\System32\spoolsv.exe[2000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1136] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\dashost.exe[2340] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\Intel\iCLS Client\HeciServer.exe[2348] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163            000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\CyberLink\Shared files\RichVideo64.exe[2476] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163      000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\SearchIndexer.exe[2892] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                        000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[2944] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                              000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                  000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                               000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                         000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                           000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                              000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                      000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                              000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                     000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                               000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                     000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                              000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                               000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                           000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                             000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                  000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                              000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                  000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                        000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                          000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                             000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                  000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWinEvent                                     000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWinEventHook                                    000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                  000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                     000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                             000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                    000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                              000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                    000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                             000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                              000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                          000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                             000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                  000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                              000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                  000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                        000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                          000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                             000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                  000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWinEvent                                     000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWinEventHook                                    000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                  000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                     000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                             000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                    000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                              000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                    000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                             000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                              000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                          000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                  000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                      000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                   000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                             000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                               000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                                  000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                     000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                       000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWinEvent                                          000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWinEventHook                                         000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                       000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                          000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                  000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                         000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                   000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                         000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                  000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                   000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                               000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                           000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text   C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                           000007f8bf771782 4 bytes [77, BF, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory     000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory         000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory      000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                  000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx        000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExW          000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWinEvent             000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWinEventHook            000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExA          000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!DeleteService             000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W     000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW            000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW      000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA            000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A     000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA      000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity  000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690        000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698        000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246      000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                               000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                   000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                          000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                            000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                               000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                  000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                    000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWinEvent                                       000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWinEventHook                                      000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                    000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                       000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                               000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                      000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                      000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                               000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                            000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 690                                  000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 698                                  000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246                                000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                        000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text   C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                        000007f8bf771782 4 bytes [77, BF, F8, 07]
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                           000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                               000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                            000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                      000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                        000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                           000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                   000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                           000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                  000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                            000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                  000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                           000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                            000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                        000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWindowsHookEx                              000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExW                                000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWinEvent                                   000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWinEventHook                                  000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExA                                000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                      000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                          000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                           000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                       000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                           000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                   000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                                      000007f8bd8df7eb 1 byte [62]
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                         000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                           000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWinEvent                                              000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWinEventHook                                             000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                           000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                              000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                      000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                             000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                       000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                             000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                      000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                       000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                   000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                               000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text   C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                               000007f8bf771782 4 bytes [77, BF, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory       000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory           000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess            000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory        000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread            000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                  000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                    000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163       000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx          000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExW            000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWinEvent               000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWinEventHook              000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExA            000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690          000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698          000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246        000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!DeleteService               000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W       000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW              000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW        000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA              000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A       000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA        000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity    000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                  000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                   000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                   000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                         000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163              000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExW                   000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWinEvent                      000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWinEventHook                     000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExA                   000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246               000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!DeleteService                      000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W              000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                     000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW               000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                     000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A              000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA               000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity           000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                       000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                           000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                            000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                        000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                            000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                  000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                    000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163                       000007f8bd8df7eb 1 byte [62]
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                          000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExW                            000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWinEvent                               000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWinEventHook                              000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExA                            000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!DeleteService                               000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                       000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                              000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                        000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                              000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                       000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                        000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text   C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                    000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [3704:3688]                                                                                fffff960008805e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                    unknown MBR code

---- EOF - GMER 2.1 ----

Viele Grüße und ein dickes Dankeschön schon mal an Euch
SuNi

schrauber · 13.08.2013, 15:56

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

SuNi67 · 13.08.2013, 16:26

Hallo Schrauber

Wow, das ging ja superschnell

Vielen Dank, dass Du dich meines Problems annimmst!!

Hier das gewünschte combofix-log:

Code:

ATTFilter

ComboFix 13-08-12.01 - Sanne 13.08.2013  17:13:39.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.4038.2688 [GMT 2:00]
ausgeführt von:: c:\users\Sanne\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-07-13 bis 2013-08-13  ))))))))))))))))))))))))))))))
.
.
2013-08-13 15:17 . 2013-08-13 15:17	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-08-13 15:17 . 2013-08-13 15:17	--------	d-----w-	c:\users\Sanne\AppData\Local\temp
2013-08-13 15:17 . 2013-08-13 15:17	--------	d-----w-	c:\users\Philipp\AppData\Local\temp
2013-08-13 13:49 . 2013-08-13 13:49	--------	d-----w-	C:\FRST
2013-08-13 13:37 . 2013-08-13 13:37	--------	d-----w-	c:\program files (x86)\7-Zip
2013-08-12 17:30 . 2013-08-12 17:30	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2013-08-12 14:30 . 2013-08-12 14:30	261808	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10213.bin
2013-07-21 19:04 . 2013-07-21 19:06	--------	d-----w-	c:\windows\system32\MRT
2013-07-20 14:17 . 2013-06-27 22:04	78200	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-20 14:17 . 2013-06-27 22:04	693112	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-20 13:58 . 2013-06-11 23:25	15404032	----a-w-	c:\windows\system32\ieframe.dll
2013-07-20 13:58 . 2013-06-11 23:25	19238912	----a-w-	c:\windows\system32\mshtml.dll
2013-07-20 13:58 . 2013-06-11 23:25	3958784	----a-w-	c:\windows\system32\jscript9.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-20 09:12 . 2013-05-03 09:10	41976	----a-w-	c:\windows\system32\drivers\networx.sys
2013-06-27 19:17 . 2013-03-01 16:58	189936	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-06-27 19:17 . 2013-02-20 08:23	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-06-27 19:17 . 2013-02-20 08:23	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-06-23 22:57 . 2012-12-12 16:17	78277128	----a-w-	c:\windows\system32\MRT.exe
2013-05-30 23:24 . 2013-06-12 09:03	1257472	----a-w-	c:\windows\system32\kernel32.dll
2013-05-23 23:01 . 2013-06-12 09:03	1300992	----a-w-	c:\windows\system32\gdi32.dll
2013-05-23 22:27 . 2013-06-12 09:03	1022464	----a-w-	c:\windows\SysWow64\gdi32.dll
2013-05-23 06:25 . 2012-07-26 08:13	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-15 22:37 . 2013-06-12 09:03	44032	----a-w-	c:\windows\SysWow64\UXInit.dll
2013-05-15 22:35 . 2013-06-12 09:03	53760	----a-w-	c:\windows\system32\UXInit.dll
2013-05-15 22:35 . 2013-06-12 09:20	144384	----a-w-	c:\windows\system32\tssdisai.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2013-03-06 3093624]
"FileHippo.com"="c:\program files (x86)\FileHippo.com\UpdateChecker.exe" [2012-11-23 307712]
"SecureBanking"="c:\program files (x86)\Secure Banking\SecureBanking.exe" [2013-07-04 507904]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2013-07-08 759384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-08-23 56128]
"CLMLServer_For_P2G8"="c:\program files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe" [2012-06-08 111120]
"CLVirtualDrive"="c:\program files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" [2012-07-20 491120]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-07-13 93296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Reader Application Helper"="c:\program files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2013-03-18 899400]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ConfirmFileDelete"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
R3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n-USB 2.0-Netzwerkadapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 networx;networx;c:\windows\system32\drivers\networx.sys;c:\windows\SYSNATIVE\drivers\networx.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 CyberLink PowerDVD 10 MS Monitor Service;CyberLink PowerDVD 10 MS Monitor Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [x]
S2 CyberLink PowerDVD 10 MS Service;CyberLink PowerDVD 10 MS Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 RtlWlanu;Realtek Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlanu.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-12 14:58	1173456	----a-w-	c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2012-12-18 19:08	215264	----a-w-	c:\program files (x86)\Adobe\Reader 11.0\Esl\AiodLite.dll
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-01 14:24]
.
2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 10:41]
.
2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 10:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-08-20 13192848]
"NetWorx"="c:\program files\NetWorx\networx.exe" [2013-07-24 4886648]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://lenovo13.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\
FF - ExtSQL: 2013-08-13 11:41; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - ExtSQL: 2013-08-13 11:42; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-08-13  17:18:58
ComboFix-quarantined-files.txt  2013-08-13 15:18
.
Vor Suchlauf: 13 Verzeichnis(se), 1.855.553.593.344 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 1.855.953.498.112 Bytes frei
.
- - End Of File - - 1B1DF7CD36BF979F82636FE5BFE8F6BB
D41D8CD98F00B204E9800998ECF8427E

Viele Grüße
SuNi

schrauber · 13.08.2013, 18:20

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

SuNi67 · 13.08.2013, 19:51

So, ich glaube, jetzt habe ich alles zusammen

1. MBAM

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.13.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16635
Sanne :: SANNE2 [Administrator]

13.08.2013 20:00:14
mbam-log-2013-08-13 (20-00-14).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 318560
Laufzeit: 2 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

2.AdwCleaner (1 Neustart)

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 13/08/2013 um 20:09:32 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzer : Sanne - SANNE2
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sanne\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v23.0 (de)

Datei : C:\Users\Jürgen\AppData\Roaming\Mozilla\Firefox\Profiles\fklcd9c4.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\h247z9js.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\aoo1lnp8.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v28.0.1500.95

Datei : C:\Users\Jürgen\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Philipp\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1577 octets] - [13/08/2013 20:07:18]
AdwCleaner[S1].txt - [1510 octets] - [13/08/2013 20:09:32]

########## EOF - C:\AdwCleaner[S1].txt - [1570 octets] ##########

3.JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.4 (08.12.2013:1)
OS: Windows 8 x64
Ran by Sanne on 13.08.2013 at 20:18:14,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Sanne\AppData\Roaming\mozilla\firefox\profiles\nr0cwijt.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.08.2013 at 20:21:16,62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und zu guter Letzt noch FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013 01
Ran by Sanne (administrator) on 13-08-2013 20:28:56
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] -  [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 20:28 - 01575274 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-07-21 21:06 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:58 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 15:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-20 15:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-13 20:28 - 2013-08-13 15:44 - 01575274 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-13 20:21 - 2013-08-13 20:21 - 00000743 _____ C:\Users\Sanne\Desktop\JRT.txt
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:15 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-13 20:15 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-13 20:15 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-13 20:12 - 2012-11-29 12:05 - 01234496 _____ C:\Windows\WindowsUpdate.log
2013-08-13 20:11 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 20:11 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 20:10 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-13 20:10 - 2012-08-28 13:13 - 00164596 _____ C:\Windows\PFRO.log
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 20:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-13 19:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 19:56 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 22:16 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 21:06 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 11:50

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition.txt gab's diesmal keine.

Und der QuickLauncher funktioniert jetzt auch wieder ohne Fehlermeldung *juchu*

Kannst du mir verraten, was unser lieber Sohn da mit seiner Spiele-, YouTube-, und Skype-Leidenschaft eingeschleppt hat (er ist nämlich auf diesem Rechner der Hauptnutzer und weigert sich hartnäckig Sandboxie zu nutzen

)?
Und muss ich jetzt sicherheitshalber außerplanmäßig Passwörter ändern?

Liebe Grüße
SuNi

schrauber · 14.08.2013, 15:40

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

SuNi67 · 14.08.2013, 19:27

Geschafft, alles fertig!

1.Eset

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=387e51afe9353e48a4be8bf0e232329c
# engine=14773
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-14 05:27:42
# local_time=2013-08-14 07:27:42 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode=774 16777213 85 91 2170915 153211134 0 0
# compatibility_mode=5893 16776574 100 94 13341322 24109392 0 0
# scanned=264646
# found=0
# cleaned=0
# scan_time=4112

2.SecurityCheck

Code:

ATTFilter

Results of screen317's Security Check version 0.99.72  
   x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
Windows Defender   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Secunia PSI (3.0.0.6005)   
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Flash Player 	11.8.800.94  
 Adobe Reader XI  
 Mozilla Firefox (23.0) 
 Mozilla Thunderbird (17.0.8) 
 Google Chrome 28.0.1500.72  
 Google Chrome 28.0.1500.95  
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Windows Defender MsMpEng.exe   
 Windows Defender MpCmdRun.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

3. FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Sanne (administrator) on 14-08-2013 19:57:25
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] -  [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-14 10:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 10:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 10:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 10:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 10:24 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 10:24 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-14 07:49 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-08-14 19:29 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 19:43 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-14 19:43 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-14 19:43 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-14 19:40 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-14 19:39 - 2012-11-29 12:05 - 01617838 _____ C:\Windows\WindowsUpdate.log
2013-08-14 19:38 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-14 19:38 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-14 19:32 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 19:29 - 2012-12-12 18:17 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 19:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-14 19:02 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-14 18:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-14 13:09 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-14 07:49 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:10 - 2012-08-28 13:13 - 00164596 _____ C:\Windows\PFRO.log
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-26 07:13 - 2013-08-14 10:25 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 10:25 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 10:25 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 02:54 - 2013-08-14 10:25 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 11:50

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Im Wartungscenter scheint irgendwas verstellt zu sein: Direkt nach Beendigung von eset hatte sich die Systemwartung einfach so eingeschaltet (trotzdem ich die Kiste erst vor 2 Tagen gewartet hatte), die hab ich erst mal wieder gestoppt.

Dann hatte ich mich noch bei der Reaktivierung meines Antivirenprogramms verklickt und aus Versehen den Defender aktiviert, der sich dann über das Wartungscenter erst mal nicht mehr wieder beenden ließ. Ein Neustart hat daran erst mal nix geändert...Dummerweise hatte das blöde ding irgendwann in der Zwischenzeit Windows-Updates runtergeladen und dann während genau dieses Neustarts installiert - Ich hoffe, dass hat jetzt nix kaputt gemacht

Erst als ich dann versuchsweise einfach Avast mal wieder, reaktiviert habe verschwand der defender aus der Anzeige im Wartungscenter und avast scheint wieder zu laufen...Ich habe aber keine Ahnung, ob es jetzt wirklich in Ordnung ist ...

Achja, außerdem kann ich seit gestern in firefox keine Lesezeichen setzen - wollte diesen thread bookmarken, geht aber nicht - ich muss ihn immer übers Kontrollzentrum aufrufen (aber den FF neu zu installieren wäre ja gar kein Prob.)

So, lieber Schrauber,

was meinst du, kriegst du das wieder in den Griff?

Viele Grüße
SuNi

schrauber · 15.08.2013, 08:25

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Installier den FF mal neu und berichte ob es noch Probleme gibt

SuNi67 · 15.08.2013, 10:38

Guten Morgen, Schrauber

hier zunächst einmal das Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-08-2013 01
Ran by Sanne at 2013-08-15 11:15:04 Run:1
Running from C:\Users\Sanne\Desktop
Boot Mode: Normal
==============================================

X6va011 => Service deleted successfully.
X6va012 => Service deleted successfully.

==== End of Fixlog ====

und dann noch ein Update zum Zustand des PCs:
Scheint fast alles zu funktionieren, wie es soll - auch der WindowsDefender scheint tatsächlich deaktiviert und nur Avast aktiviert zu sein

FF funktioniert nach Neu-Installation wieder fehlerfrei.
Jedoch ist mir bei der Überprüfung der anderen Browser aufgefallen, dass der IE in keinem Benutzerkonto funktioniert (den hatte ich vergessen, weil er von uns nicht genutzt wird). Er startet zwar, lädt aber keine Seite...und das ist auch nach Fix und Neustart so geblieben.

Viele Grüße
SuNi

schrauber · 15.08.2013, 14:35

Setze folgendermassen den Internet Explorer zurück:

Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.

(Hier findest du die bebilderte Anleitung.)

SuNi67 · 15.08.2013, 18:12

Hallo Schrauber

Das hat geklappt - der IE funktioniert jetzt wieder in allen Konten

Und bis jetzt hab ich auch keine neue Katastrophe gefunden

Viele Grüße
SuNi

Update um 19:00 Uhr

Hallo Schrauber,

leider scheint das Absturz-Problem noch nicht vollständig behoben

Als ich gerade eben den Rechner mit eingeschränkten Nutzerrechten startete und dann nach dem Systemstart FF in der Sandboxie starten wollte - Bluesccreen, mit Hinweis, dass der PC neugestartet werden müsse - Fehlerdetails sind einzusehen unter PAGE_FAULT_IN... (für den Rest war ich zu langsam)

Nach den Neustart dann Blackscreen mit " Reboot and select propper boot deveice or insert boot media in selected boot device and press a key"

Also hab ich das Ding in altbewähter Manier wieder ausgemacht und neugestartet....

Ich denke mal, da willst Du bestimmt en frisches FRST-log, oder?!

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Sanne (administrator) on 15-08-2013 18:58:45
Running from C:\Users\Sanne\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Secure Banking) C:\Program Files (x86)\Secure Banking\SecureBanking.exe
() C:\Program Files (x86)\Secure Banking\sbservice.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] -  [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation                           )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-15 11:22 - 2013-08-15 11:22 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-15 11:17 - 2013-08-15 11:17 - 22268584 _____ (Mozilla) C:\Users\Sanne\Downloads\Firefox Setup 23.0.exe
2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-14 10:26 - 2013-05-24 01:02 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 10:26 - 2013-05-24 00:25 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-08-14 10:25 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 10:25 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 10:25 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 10:25 - 2013-07-26 05:13 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 10:25 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 10:25 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 10:25 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 10:25 - 2013-07-26 02:54 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-08-14 10:25 - 2013-07-09 08:07 - 02233168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 10:25 - 2013-07-02 02:44 - 00036288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2013-08-14 10:25 - 2013-07-02 00:08 - 00247216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2013-08-14 10:24 - 2013-07-13 08:18 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 01889280 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:24 - 2013-07-13 08:16 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 08:15 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2013-08-14 10:24 - 2013-07-13 06:24 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 01568256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2013-08-14 10:24 - 2013-07-13 06:23 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:56 - 2013-08-14 20:28 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:12 - 2013-08-13 17:19 - 00000000 ____D C:\Qoobox
2013-08-13 17:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-13 17:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-13 17:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-13 17:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-13 17:11 - 2013-08-13 17:17 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-15 18:53 - 476533879 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-15 18:53 - 00000000 ____D C:\Windows\Minidump
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-11 12:03 - 2013-08-15 11:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-08-14 19:32 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-15 18:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-15 18:58 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-15 18:58 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-15 18:58 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 18:57 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-15 18:54 - 2012-11-29 12:05 - 01321165 _____ C:\Windows\WindowsUpdate.log
2013-08-15 18:53 - 2013-08-15 18:53 - 00290648 _____ C:\Windows\Minidump\081513-15609-01.dmp
2013-08-15 18:53 - 2013-08-12 19:07 - 476533879 _____ C:\Windows\MEMORY.DMP
2013-08-15 18:53 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-15 18:53 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-15 18:53 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-15 16:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-15 16:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-15 15:52 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-15 15:39 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-15 11:53 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-15 11:22 - 2013-08-15 11:22 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-15 11:22 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 11:17 - 2013-08-15 11:17 - 22268584 _____ (Mozilla) C:\Users\Sanne\Downloads\Firefox Setup 23.0.exe
2013-08-15 10:31 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-15 08:01 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-15 08:01 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-15 07:51 - 2013-05-29 13:15 - 00000000 ____D C:\Users\Philipp\Desktop\Maxi
2013-08-15 07:47 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-14 20:50 - 2012-08-28 13:13 - 00165430 _____ C:\Windows\PFRO.log
2013-08-14 20:28 - 2013-08-13 19:56 - 00000000 ____D C:\Users\Sanne\Desktop\reinigung
2013-08-14 19:56 - 2013-08-14 19:56 - 01575570 _____ (Farbar) C:\Users\Sanne\Desktop\FRST64.exe
2013-08-14 19:46 - 2013-08-14 19:46 - 00891115 _____ C:\Users\Sanne\Desktop\SecurityCheck.exe
2013-08-14 19:32 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 19:29 - 2012-12-12 18:17 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 18:16 - 2013-08-14 18:16 - 02347384 _____ (ESET) C:\Users\Sanne\Desktop\esetsmartinstaller_enu.exe
2013-08-13 20:18 - 2013-08-13 20:18 - 00000000 ____D C:\Windows\ERUNT
2013-08-13 20:16 - 2013-08-13 20:16 - 01158722 _____ (Thisisu) C:\Users\Sanne\Desktop\JRT.exe
2013-08-13 20:09 - 2013-08-13 20:09 - 00001639 _____ C:\AdwCleaner[S1].txt
2013-08-13 20:07 - 2013-08-13 20:07 - 00001577 _____ C:\AdwCleaner[R1].txt
2013-08-13 20:04 - 2013-08-13 20:04 - 00666633 _____ C:\Users\Sanne\Desktop\adwcleaner.exe
2013-08-13 19:33 - 2013-03-14 11:32 - 00002498 _____ C:\Windows\Sandboxie.ini
2013-08-13 17:19 - 2013-08-13 17:12 - 00000000 ____D C:\Qoobox
2013-08-13 17:19 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-08-13 17:18 - 2013-08-13 17:18 - 00012685 _____ C:\ComboFix.txt
2013-08-13 17:17 - 2013-08-13 17:11 - 00000000 ____D C:\Windows\erdnt
2013-08-13 17:17 - 2012-07-26 07:26 - 00000215 _____ C:\Windows\system.ini
2013-08-13 17:05 - 2013-08-13 17:05 - 05102975 ____R (Swearware) C:\Users\Sanne\Desktop\ComboFix.exe
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research                                        ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-26 07:13 - 2013-08-14 10:25 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-07-26 07:13 - 2013-08-14 10:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 10:25 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 10:25 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:13 - 2013-08-14 10:25 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 10:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 10:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 10:25 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 02:54 - 2013-08-14 10:25 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 11:50

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition.txt gabs auch diesmal keine.

Kann das Problem mit Sandboxie zusammenhängen? Das war nämlich auch beim allerersten Absturz beteiligt, allerdings ja dann nicht beim schwarzen Bildschirm direkt nach Drücken des Startknopfs...

Ich hoffe, Dir fällt noch was dazu ein ansonsten

Viele Grüße
SuNi

schrauber · 15.08.2013, 20:08

Deinstallier das mal und installier es neu. Und beobachte. Wenn das nochmal kommt brauch ich das aktuelle Dumpfile aus dem Ordner C:\Windows\Minidump um den Absturz zu analysieren.

SuNi67 · 16.08.2013, 08:59

Guten Morgen Schrauber

Sandboxie ist jetzt deinstalliert. Da mein Sohn es, wie gesagt, sowieso nicht nutzt, wollte ich es auf diesem Rechner eigentlich auch vorerst nicht wieder installieren (sondern dann lieber mit WinPatrol versuchen)...Es sei denn, Du bist der Meinung, es wäre zur Ursachenfindung evtl. sinnvoll.

Die Minidumps vom 13.8. und von gestern würde ich dir zwar sehr gerne schicken, allerdings kann ich keine .dmp-Dateien hier einfügen und habe auch keine Ahnung in welchem Programm die geöffnet gehören.

Viele Grüße
SuNi

P:S Der QuickLauncher hat seinen Geist wieder ausgehaucht

schrauber · 16.08.2013, 15:55

Zip es mit 7zip oder Winrar, dann kannste das Dumpfile hochladen

SuNi67 · 16.08.2013, 16:31

Hallo Schrauber

na, dann versuche ich es mal - in dem einen Zip-Ordner sollte das minidump des ersten Absturzes sein und in dem zweiten hoffentlich das vom gestrigen. Allerdings bin ich nicht sicher, da 7zip mir beide Male die Fehler meldung "Zugriff verweigert" angezeigt hat...

Von dem Blackscreen mit weißem Mauszeiger direkt nach Anschalten des PCs gab's scheinbar kein dumpfile.

Viele Grüße

SuNi

16.08.2013, 15:55	#14
schrauber /// the machine /// TB-Ausbilder	Windows-8-PC mit Systemabsturz und temporärem Startproblem Zip es mit 7zip oder Winrar, dann kannste das Dumpfile hochladen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows-8-PC mit Systemabsturz und temporärem Startproblem

Log-Analyse und Auswertung: Windows-8-PC mit Systemabsturz und temporärem Startproblem