Win7 64 bit: zustätzliche Werbung im Browser, flashPlayerPlugin mit großem Speicherbedarf

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-08-2013
Ran by xxx at 2013-08-26 10:12:14
Running from C:\Users\xxx\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922)
„Windows Live Mail“ (x32 Version: 15.4.3502.0922)
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922)
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922)
Adobe AIR (x32 Version: 2.7.0.19480)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader 9.5.4 - Deutsch (x32 Version: 9.5.4)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
AVM FRITZ!Box Dokumentation (x32)
AVM FRITZ!Box Druckeranschluss (x32)
BatteryLifeExtender (x32 Version: 1.0.11)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Broadcom 802.11 Network Adapter (Version: 5.60.48.55)
Build-a-lot (x32 Version: 2.2.0.82)
ChargeableUSB (x32 Version: 1.0.0.0)
Chuzzle Deluxe (x32 Version: 2.2.0.82)
Common Desktop Agent (Version: 1.62.0)
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00)
CyberLink MediaShow (x32 Version: 5.0.1130a)
CyberLink Power2Go (x32 Version: 6.1.3802)
CyberLink PowerDirector (x32 Version: 8.0.3306)
CyberLink YouCam (x32 Version: 3.1.3509)
D3DX10 (x32 Version: 15.4.2368.0902)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82)
dm-Fotowelt (x32 Version: 5.0.1)
dows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (01/19/2011 1.0.0009.0) (Version: 01/19/2011 1.0.0009.0)
Easy Content Share (x32 Version: 1.0)
Easy Display Manager (x32 Version: 3.2)
Easy Migration (x32 Version: 1.0)
Easy Network Manager (x32 Version: 4.4.7)
Easy SpeedUp Manager (x32 Version: 2.1.1.1)
EasyBatteryManager (x32 Version: 4.0.0.4)
EasyFileShare (x32 Version: 1.0.11)
Farm Frenzy (x32 Version: 2.2.0.82)
Fast Start (x32 Version: 2.2.0.1)
FileZilla Client 3.5.3 (x32 Version: 3.5.3)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Free YouTube to MP3 Converter version 3.11.24.608 (x32 Version: 3.11.24.608)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
GIMP 2.8.2 (Version: 2.8.2)
Google Drive (x32 Version: 1.11.4865.2530)
Google Talk Plugin (x32 Version: 4.4.2.14502)
Google Update Helper (x32 Version: 1.3.21.153)
Insaniquarium Deluxe (x32 Version: 2.2.0.82)
Intel PROSet Wireless
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2622)
Intel(R) PROSet/Wireless WiFi Software (Version: 14.0.2000)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
John Deere Drive Green (x32 Version: 2.2.0.82)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Color Enhancer (x32 Version: 1.0)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
Multimedia POP (x32 Version: 1.1)
Norton Internet Security (x32 Version: 18.7.2.3)
Norton Online Backup (x32 Version: 2.1.17869)
NVIDIA Display Control Panel (Version: 6.14.12.6672)
NVIDIA Graphics Driver 266.72 (Version: 266.72)
NVIDIA Install Application (Version: 2.265.39.0)
NVIDIA Optimus 1.0.15 (Version: 1.0.15)
NVIDIA Update Components (Version: 1.0.15)
PDFCreator (x32 Version: 1.4.1)
Peggle (x32 Version: 2.2.0.82)
Penguins! (x32 Version: 2.2.0.82)
PhoneShare (x32 Version: 9.1.4)
Plants vs. Zombies (x32 Version: 2.2.0.82)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Polar Golfer (x32 Version: 2.2.0.82)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller Driver (x32 Version: 7.36.1224.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400)
Remote Control USB Driver (x32 Version: 2.3.2.317)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.30.0)
Samsung AnyWeb Print (x32 Version: 2.0.67.1)
Samsung CLP-360 Series (x32 Version: 1.01 (01.05.2012))
Samsung Easy Printer Manager (x32 Version: 1.02.45.02(01.05.2012))
Samsung Printer Live Update (x32 Version: 1.01.00.04)
Samsung Recovery Solution 5 (x32 Version: 5.0.0.9)
Samsung Support Center 1.0 (x32 Version: 1.1.38)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0)
Samsung Update Plus (x32 Version: 3.0.0.17)
SES Driver (Version: 1.0.0)
Skype™ 5.10 (x32 Version: 5.10.116)
Sony Ericsson Update Engine (x32 Version: 2.13.6.201305161305)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Synaptics Pointing Device Driver (Version: 15.3.22.0)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
User Guide (x32 Version: 1.2)
WIDCOMM Bluetooth Software (Version: 6.3.0.7000)
WildTangent Games (x32 Version: 1.0.1.5)
WildTangent ORB Game Console (x32)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live fotoattēlu galerija (x32 Version: 15.4.3502.0922)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Foto-galerija (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Pošta (x32 Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 메일 (x32 Version: 15.4.3502.0922)
Windows Live 사진 갤러리 (x32 Version: 15.4.3502.0922)
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922)
Windows Live 影像中心 (x32 Version: 15.4.3502.0922)
Windows Live 照片库 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3508.1109)
Windows Live 软件包 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WISO Mein Geld 2012 Professional (x32 Version: 14.0.1.18)
WISO Mein Geld 2012 Professional (x32)
WISO Steuer-Sparbuch 2012 (x32 Version: 19.10.7954)
WISO Steuer-Sparbuch 2013 (x32 Version: 20.08.8317)
WordCaptureX Pro (x32 Version: 4.0.0)
Zuma Deluxe (x32 Version: 2.2.0.95)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
معرض صور Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

11-07-2013 08:45:55 Windows Update
16-08-2013 08:08:32 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {00EB865B-3B9C-4724-83A3-2CBE9A238E45} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003UA => C:\Users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-12] (Google Inc.)
Task: {06EED385-AFCA-4466-BCAB-AC663DCB847A} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {29994790-7FEC-495F-9EAE-4543CAA46663} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {300CF244-7AD4-4649-B677-107223AAF812} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {37927341-A299-460A-80AB-D57B6A708934} - System32\Tasks\WPD\SqmUpload_S-1-5-21-478711191-1416624994-1632020750-1003 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {4B956895-FFB0-4DE2-9D38-AF60B90D5A79} - System32\Tasks\WPD\SqmUpload_S-1-5-21-478711191-1416624994-1632020750-1002 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {692F7FB1-FADE-4690-B4A6-4171901284A7} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2010-02-10] (Samsung Electronics Co., Ltd.)
Task: {6B6D4D73-061B-4778-B5BD-B038ABA7DE41} - System32\Tasks\Lyrics-Pal Update => C:\Program Files (x86)\LyricsPal\Lyrics.exe [2013-08-21] ()
Task: {7BCD71C3-2AE1-4CE4-95DE-A5FAD46DD47D} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {934D13D5-A259-42A4-9649-27AF10F3DAB9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003Core => C:\Users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-12] (Google Inc.)
Task: {983E223A-EFAF-4EE7-911C-B6D9DCB9E131} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {A7767FE4-A7AE-4959-9DEB-D0CD33E977F0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-11] (Google Inc.)
Task: {AA9A8981-1883-4FDC-B981-228A0EEF5F86} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {ADB24D8C-B6D6-4D13-8DE2-67EA9D8133D9} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics)
Task: {B9C1DC11-1694-4DA9-90D6-F1E20BB604E6} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {C072B880-9ED3-43CE-A55F-1781CEF5B256} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-11] (Google Inc.)
Task: {CECB9487-AE44-42F6-86D6-1797EACD195F} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-09-04] (SAMSUNG Electronics)
Task: {D1A6F7F7-E437-4421-BBEE-7DB411726746} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {D1F9DA1D-EC10-4591-A070-DF62C1D5BE13} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {D951AC48-600A-405B-828E-8CCC676CCDD2} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {E1546D18-4229-419F-9AF9-0F6C1326AAD0} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {E2EA3FA1-752F-4975-B9B8-BFAC7B33EC86} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-22] (Adobe Systems Incorporated)
Task: {EEC0706C-6088-4DF4-84A1-AF135FB7959A} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {F218A9D7-80AA-4562-9AFF-CF0E58ECF809} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003Core.job => C:\Users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003UA.job => C:\Users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Lyrics-Pal Update.job => C:\Program Files (x86)\LyricsPal\Lyrics.exe


==================== Faulty Device Manager Devices =============

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2013 03:16:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 02:50:32 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 23.0.1.4974 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1110

Startzeit: 01cea186c774d9f3

Endzeit: 78

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:

Error: (08/25/2013 01:33:52 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 10:23:44 AM) (Source: Application Hang) (User: )
Description: Programm biclient.exe, Version 1.0.0.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2414

Startzeit: 01cea16c2dbe31d1

Endzeit: 24

Anwendungspfad: C:\Users\xxx\AppData\Local\Temp\biclient.exe

Berichts-ID:

Error: (08/24/2013 09:42:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/23/2013 05:28:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/22/2013 11:20:23 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (08/16/2013 10:35:26 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/13/2013 10:33:18 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (08/06/2013 03:59:39 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:


System errors:
=============
Error: (08/24/2013 03:34:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%109

Error: (08/24/2013 03:34:09 PM) (Source: DCOM) (User: )
Description: 109gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (08/24/2013 11:16:23 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (08/23/2013 10:24:44 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NIS erreicht.

Error: (08/23/2013 05:28:05 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NIS erreicht.

Error: (08/22/2013 04:46:45 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.

Error: (08/22/2013 04:46:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (08/22/2013 11:20:56 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (08/22/2013 11:20:26 AM) (Source: Service Control Manager) (User: )
Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/16/2013 10:32:59 AM) (Source: DCOM) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}


Microsoft Office Sessions:
=========================
Error: (08/25/2013 03:16:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 02:50:32 PM) (Source: Application Hang)(User: )
Description: firefox.exe23.0.1.4974111001cea186c774d9f378C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Error: (08/25/2013 01:33:52 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 10:23:44 AM) (Source: Application Hang)(User: )
Description: biclient.exe1.0.0.1241401cea16c2dbe31d124C:\Users\xxx\AppData\Local\Temp\biclient.exe

Error: (08/24/2013 09:42:24 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/23/2013 05:28:05 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/22/2013 11:20:23 AM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (08/16/2013 10:35:26 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/13/2013 10:33:18 PM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (08/06/2013 03:59:39 PM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 4009.55 MB
Available physical RAM: 2170.13 MB
Total Pagefile: 8017.28 MB
Available Pagefile: 5244.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:96.2 GB) (Free:7.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119 GB) (Disk ID: C261E388)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=96 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=23 GB) - (Type=27)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-08-2013
Ran by xxx (administrator) on 26-08-2013 10:11:29
Running from C:\Users\xxx\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Spotify Ltd) C:\Users\xxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\xxx\AppData\Roaming\Spotify\spotify.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818856 2011-08-25] (Synaptics Incorporated)
HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [x]
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [x]
HKCU\...\Run: [Spotify Web Helper] - C:\Users\xxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-08-16] (Spotify Ltd)
HKCU\...\Run: [Spotify] - C:\Users\xxx\AppData\Roaming\Spotify\Spotify.exe [4640768 2013-08-16] (Spotify Ltd)
HKCU\...\Run: [Google Update] - C:\Users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-12] (Google Inc.)
MountPoints2: {7bf46915-ce84-11e2-a299-e0ca9444b1a5} - E:\Startme.exe
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\xxx2\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
AppInit_DLLs: C:\windows\system32\nvinitx.dll [226920 2011-01-17] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll [192616 2011-01-17] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\pc1kunbn.default
FF user.js: detected! => C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\pc1kunbn.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\xxx\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\xxx\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\xxx\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\xxx\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\xxx\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: DownloadHelper - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\pc1kunbn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF HKCU\...\Firefox\Extensions: [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}] C:\Program Files (x86)\LyricsPal\128.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\128.xpi

==================== Services (Whitelisted) =================

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] ()

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-25] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130825.019\ENG64.SYS [126040 2013-08-02] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130825.019\ENG64.SYS [126040 2013-08-02] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130825.019\EX64.SYS [2098776 2013-08-02] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130825.019\EX64.SYS [2098776 2013-08-02] (Symantec Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-23] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-23] (Windows (R) 2003 DDK 3790 provider)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-06-20] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-26 10:07 - 2013-08-26 10:07 - 00000000 _____ C:\Users\xxx\defogger_reenable
2013-08-26 10:06 - 2013-08-26 10:06 - 00377856 _____ C:\Users\xxx\Desktop\gmer_2.1.19163.exe
2013-08-26 10:05 - 2013-08-26 10:05 - 00050477 _____ C:\Users\xxx\Desktop\Defogger.exe
2013-08-26 09:53 - 2013-08-26 09:53 - 00024223 _____ C:\Users\xxx\Downloads\Addition.txt
2013-08-26 09:52 - 2013-08-26 09:52 - 00000000 ____D C:\FRST
2013-08-26 09:51 - 2013-08-26 09:51 - 01577068 _____ (Farbar) C:\Users\xxx\Desktop\FRST64.exe
2013-08-25 12:02 - 2013-08-25 12:02 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\windows\system32\Drivers\stflt.sys
2013-08-25 12:01 - 2013-08-25 12:01 - 05049344 _____ (Crawler.com                                                 ) C:\Users\xxx\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-08-25 11:02 - 2013-08-25 11:02 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Malwarebytes
2013-08-25 11:01 - 2013-08-25 11:01 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 11:01 - 2013-08-25 11:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-25 11:01 - 2013-08-25 11:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 11:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-08-25 11:00 - 2013-08-25 11:01 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\xxx\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-25 10:22 - 2013-08-26 10:12 - 00000366 _____ C:\windows\Tasks\Lyrics-Pal Update.job
2013-08-25 10:22 - 2013-08-25 13:03 - 00000000 ____D C:\Program Files (x86)\LyricsPal
2013-08-25 10:22 - 2013-08-25 10:22 - 00003016 _____ C:\windows\System32\Tasks\Lyrics-Pal Update
2013-08-19 19:15 - 2013-08-19 19:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 18:14 - 2013-08-16 18:14 - 00000000 ____D C:\Users\xxx\Documents\Homepage ATSV
2013-08-16 18:13 - 2013-08-16 18:16 - 00000000 ____D C:\Users\xxx\AppData\Roaming\KompoZer
2013-08-16 18:12 - 2013-08-16 18:12 - 00000000 ____D C:\Program Files\kompozer
2013-08-16 10:15 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-16 10:15 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-16 10:15 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-08-16 10:15 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-16 10:15 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-08-16 10:15 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-16 10:15 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-16 10:15 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-08-16 10:15 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-16 10:15 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-16 10:15 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-08-16 10:15 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-16 10:15 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-08-16 10:15 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 10:08 - 2013-08-16 10:11 - 00000000 ____D C:\windows\system32\MRT
2013-08-15 13:59 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-15 13:59 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-15 13:59 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-15 13:59 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-15 13:59 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-15 13:59 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-15 13:59 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-15 13:59 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-15 13:54 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-15 13:54 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-15 13:53 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-15 13:53 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-15 13:53 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-08-15 13:53 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-08-15 13:53 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-08-15 13:53 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-15 13:53 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-08-15 13:53 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-08-15 13:53 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-08-15 13:53 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-15 13:53 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-08-15 13:53 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-08-15 13:53 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-08-15 13:53 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-08-15 13:53 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-08-15 13:53 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-15 13:53 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-08-26 10:07 - 2013-08-26 10:07 - 00000474 _____ C:\Users\xxx\Desktop\defogger_disable.log
2013-08-26 10:07 - 2013-08-26 10:07 - 00000000 _____ C:\Users\xxx\defogger_reenable
2013-08-26 10:07 - 2012-06-19 21:07 - 00000000 ____D C:\Users\xxx
2013-08-26 10:06 - 2013-08-26 10:06 - 00377856 _____ C:\Users\xxx\Desktop\gmer_2.1.19163.exe
2013-08-26 10:05 - 2013-08-26 10:05 - 00050477 _____ C:\Users\xxx\Desktop\Defogger.exe
2013-08-26 10:05 - 2012-06-25 10:10 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-08-26 10:02 - 2013-05-31 11:14 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003UA.job
2013-08-26 10:02 - 2013-05-31 11:14 - 00001072 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-478711191-1416624994-1632020750-1003Core.job
2013-08-26 10:02 - 2012-07-11 17:03 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-26 10:02 - 2012-07-11 17:03 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-26 09:54 - 2011-07-16 17:33 - 01067774 _____ C:\windows\WindowsUpdate.log
2013-08-26 09:53 - 2013-08-26 09:53 - 00024223 _____ C:\Users\xxx\Downloads\Addition.txt
2013-08-26 09:53 - 2012-11-18 00:19 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Spotify
2013-08-26 09:52 - 2013-08-26 09:52 - 00000000 ____D C:\FRST
2013-08-26 09:51 - 2013-08-26 09:51 - 01577068 _____ (Farbar) C:\Users\xxx\Desktop\FRST64.exe
2013-08-25 15:21 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 15:21 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 15:19 - 2011-07-16 04:58 - 00654844 _____ C:\windows\system32\perfh007.dat
2013-08-25 15:19 - 2011-07-16 04:58 - 00130426 _____ C:\windows\system32\perfc007.dat
2013-08-25 15:19 - 2009-07-14 07:13 - 01500254 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-25 15:14 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-08-25 15:14 - 2009-07-14 06:51 - 00064700 _____ C:\windows\setupact.log
2013-08-25 13:32 - 2012-11-18 00:20 - 00000000 ____D C:\Users\xxx\AppData\Local\Spotify
2013-08-25 13:32 - 2009-07-14 06:45 - 00281992 _____ C:\windows\system32\FNTCACHE.DAT
2013-08-25 13:31 - 2012-06-20 21:58 - 00000000 ____D C:\Users\xxx\AppData\Roaming\SoftGrid Client
2013-08-25 13:31 - 2012-06-20 18:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-25 13:31 - 2010-11-21 05:47 - 00045372 _____ C:\windows\PFRO.log
2013-08-25 13:03 - 2013-08-25 10:22 - 00000000 ____D C:\Program Files (x86)\LyricsPal
2013-08-25 12:02 - 2013-08-25 12:02 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\windows\system32\Drivers\stflt.sys
2013-08-25 12:01 - 2013-08-25 12:01 - 05049344 _____ (Crawler.com                                                 ) C:\Users\xxx\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-08-25 11:29 - 2013-01-03 17:16 - 00000072 _____ C:\Users\Public\LMDebug.log
2013-08-25 11:29 - 2012-07-11 17:10 - 00000000 ___RD C:\Users\Public\Documents\Google Drive
2013-08-25 11:02 - 2013-08-25 11:02 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Malwarebytes
2013-08-25 11:01 - 2013-08-25 11:01 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 11:01 - 2013-08-25 11:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-25 11:01 - 2013-08-25 11:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 11:01 - 2013-08-25 11:00 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\xxx\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-25 10:56 - 2013-01-04 18:21 - 00000000 ____D C:\Users\xxx\Documents\Mein Steuer-Sparbuch Heute
2013-08-25 10:56 - 2012-10-03 09:55 - 00000657 _____ C:\windows\wiso.ini
2013-08-25 10:56 - 2012-10-03 09:54 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH
2013-08-25 10:52 - 2012-06-20 22:12 - 00064688 _____ C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-25 10:22 - 2013-08-25 10:22 - 00003016 _____ C:\windows\System32\Tasks\Lyrics-Pal Update
2013-08-22 17:36 - 2012-06-25 10:10 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 17:36 - 2012-06-25 10:10 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-22 17:36 - 2012-06-25 10:10 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-19 19:15 - 2013-08-19 19:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 18:16 - 2013-08-16 18:13 - 00000000 ____D C:\Users\xxx\AppData\Roaming\KompoZer
2013-08-16 18:14 - 2013-08-16 18:14 - 00000000 ____D C:\Users\xxx\Documents\Homepage ATSV
2013-08-16 18:13 - 2012-06-19 21:07 - 00000000 ____D C:\Users\xxx\AppData\Local\VirtualStore
2013-08-16 18:12 - 2013-08-16 18:12 - 00000000 ____D C:\Program Files\kompozer
2013-08-16 10:11 - 2013-08-16 10:08 - 00000000 ____D C:\windows\system32\MRT
2013-08-16 10:08 - 2012-06-19 21:59 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-07 07:52 - 2012-06-20 21:21 - 00000000 ____D C:\Users\xxx\AppData\Roaming\Mozilla
2013-08-03 18:54 - 2013-05-16 09:13 - 00000000 ____D C:\Users\xxx\Desktop\Baby

Files to move or delete:
====================
C:\Users\xxx2\AppData\Local\Temp\unrar.dll
C:\Users\xxx2\AppData\Local\Temp\WISOMeinGeld2012SP1.exe
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI98602\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\kernel32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\mfc90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\mfc90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\mfcm90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\mfcm90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\psapi.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\python26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\pythoncom26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\PyWinTypes26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI88642\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI68562\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI32002\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\mfc90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\mfc90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\mfcm90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\mfcm90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\psapi.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\python26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\pythoncom26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\pywintypes26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI31522\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI25522\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\kernel32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\mfc90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\mfc90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\mfcm90.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\mfcm90u.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\psapi.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\python26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\pythoncom26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\PyWinTypes26.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\shell32.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxbase293u_net_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxbase293u_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxmsw293u_adv_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxmsw293u_core_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxmsw293u_html_vc.dll
C:\Users\xxx2\AppData\Local\Temp\_MEI177882\wxmsw293u_webview_vc.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Desktop.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Resource_de.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Resource_en.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Service.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_StaticRes.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\tv_w32.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\tv_w32.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\tv_x64.dll
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\tv_x64.exe
C:\Users\xxx2\AppData\Local\Temp\TeamViewer\Version7\uninstall.exe
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\dotnetfx.exe
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\gdiplus.dll
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\Resource.MG2010.dll
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\Setup.exe
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\shelper.dll
C:\Users\xxx2\AppData\Local\Temp\Setup-0.tmp\WindowsInstaller-KB893803-x86.exe
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\CbsProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\CompatProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\DismCore.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\DismCorePS.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\DismHost.exe
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\DismProv.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\DmiProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\FolderProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\IntlProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\LogProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\MsiProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\OSProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\SmiProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\TransmogProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\UnattendProvider.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\wdscore.dll
C:\Users\xxx2\AppData\Local\Temp\7D78F348-6B31-4508-8E35-B424ABC4D139\WimProvider.dll
C:\Users\xxx\AppData\Local\Temp\IminentSetup.exe
C:\Users\xxx\AppData\Local\Temp\iv_uninstall.exe
C:\Users\xxx\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\xxx\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\xxx\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\xxx\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\xxx\AppData\Local\Temp\_is9E51.exe
C:\Users\xxx\AppData\Local\Temp\{E2DCC600-9240-45DD-A101-8482E3D5DE58}\{C2530D63-B66B-48B5-BB50-7C6281FE7AA6}\BrLogRx.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleCrashHandler.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleCrashHandler64.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleUpdate.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleUpdateBroker.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleUpdateOnDemand.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\GoogleUpdateSetup.exe
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdate.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_am.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ar.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_bg.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_bn.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ca.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_cs.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_da.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_de.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_el.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_en-GB.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_en.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_es-419.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_es.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_et.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_fa.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_fi.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_fil.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_fr.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_gu.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_hi.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_hr.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_hu.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_id.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_is.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_it.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_iw.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ja.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_kn.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ko.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_lt.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_lv.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ml.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_mr.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ms.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_nl.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_no.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_pl.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_pt-BR.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_pt-PT.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ro.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ru.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_sk.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_sl.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_sr.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_sv.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_sw.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ta.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_te.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_th.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_tr.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_uk.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_ur.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_vi.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_zh-CN.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\goopdateres_zh-TW.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\npGoogleUpdate3.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\psmachine.dll
C:\Users\xxx\AppData\Local\Temp\{3927653B-F5EF-487A-B752-9809A865DFDF}\psuser.dll
C:\Users\xxx\AppData\Local\Temp\{0BAF8B5C-320B-40AA-B4EB-1AB0208C3057}\{C2530D63-B66B-48B5-BB50-7C6281FE7AA6}\BrLogRx.exe
C:\Users\xxx\AppData\Local\Temp\_MEI96242\kernel32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\psapi.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\shell32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI96242\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI69242\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\kernel32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\psapi.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\shell32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI56522\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI42762\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\kernel32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\psapi.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\shell32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI35682\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\kernel32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\psapi.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\shell32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI179042\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\kernel32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\msvcp100.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\msvcr100.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\psapi.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\python27.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\pythoncom27.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\PyWinTypes27.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\shell32.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxbase294u_net_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxbase294u_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxmsw294u_adv_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxmsw294u_core_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxmsw294u_html_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI165882\wxmsw294u_webview_vc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\mfc90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\mfc90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\mfcm90.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\mfcm90u.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\python26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\pythoncom26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\PyWinTypes26.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxbase293u_net_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxbase293u_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxmsw293u_adv_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxmsw293u_core_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxmsw293u_html_vc.dll
C:\Users\xxx\AppData\Local\Temp\_MEI122322\wxmsw293u_webview_vc.dll
C:\Users\xxx\AppData\Local\Temp\VCB\NewUI.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Setup.exe
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ZHH\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\TRK\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\THA\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\SVE\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\RUS\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\PTG\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\PLK\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\NOR\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\NLD\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\KOR\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\JPN\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ITA\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\HUN\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\HEB\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\FRC\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\FRA\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\FIN\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ESP\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ESM\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ENU\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ENG\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ELL\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\DEU\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\DAN\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\CSY\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\CHT\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\CHS\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Languages\ARB\VCBResources.dll
C:\Users\xxx\AppData\Local\Temp\VCB\Graphics\NewUI.dll
C:\Users\xxx\AppData\Local\Temp\tmpsexued\googledrivesync.exe
C:\Users\xxx\AppData\Local\Temp\tmpeua4wc\googledrivesync.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Desktop.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Resource_de.dll
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Resource_en.dll
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_Service.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\TeamViewer_StaticRes.dll
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\tv_w32.dll
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\tv_w32.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\tv_x64.dll
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\tv_x64.exe
C:\Users\xxx\AppData\Local\Temp\TeamViewer\Version7\uninstall.exe
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\CbsProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\CompatProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\DismCore.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\DismCorePS.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\DismHost.exe
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\DismProv.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\DmiProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\FolderProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\IntlProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\LogProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\MsiProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\OSProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\SmiProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\TransmogProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\UnattendProvider.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\wdscore.dll
C:\Users\xxx\AppData\Local\Temp\F330BFA4-EC38-4AF5-A726-068A9DEBDEBA\WimProvider.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-25 18:36

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-26 11:17:03
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.AXM0 119,24GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\xxx\AppData\Local\Temp\ugloypob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544                               fffff800031be000 45 bytes [43, 4D, 32, 35, 01, 00, 00, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591                               fffff800031be02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- Threads - GMER 2.1 ----

Thread    C:\windows\system32\services.exe [640:756]                                                       000007fefc9194c4
Thread    C:\windows\System32\svchost.exe [360:5276]                                                       000007fef1073efc
Thread    C:\windows\System32\svchost.exe [360:5300]                                                       000007fef10b8a4c
Thread    C:\windows\System32\svchost.exe [360:5648]                                                       000007fef91a88f8
Thread    C:\windows\system32\svchost.exe [508:2860]                                                       000007fef8560ea8
Thread    C:\windows\system32\svchost.exe [508:2880]                                                       000007fef8559db0
Thread    C:\windows\system32\svchost.exe [508:2968]                                                       000007fef855aa10
Thread    C:\windows\system32\svchost.exe [508:2996]                                                       000007fef8561c94
Thread    C:\windows\system32\svchost.exe [364:3824]                                                       000007fef693506c
Thread    C:\windows\system32\svchost.exe [364:3884]                                                       000007fef91f5124
Thread    C:\windows\system32\svchost.exe [364:2800]                                                       000007fef4a6cb70
Thread    C:\windows\system32\svchost.exe [364:5852]                                                       000007fef6b15170
Thread    C:\windows\system32\svchost.exe [364:5388]                                                       000007fef6b15170
Thread    C:\windows\system32\svchost.exe [364:6696]                                                       000007fef86c1ab0
Thread    C:\windows\system32\svchost.exe [1124:1172]                                                      000007fefadd341c
Thread    C:\windows\system32\svchost.exe [1124:1180]                                                      000007fefadd3a2c
Thread    C:\windows\system32\svchost.exe [1124:1184]                                                      000007fefadd3768
Thread    C:\windows\system32\svchost.exe [1124:1188]                                                      000007fefadd5c20
Thread    C:\windows\system32\svchost.exe [1124:1820]                                                      000007fef934bd88
Thread    C:\windows\system32\svchost.exe [1124:3844]                                                      000007fef6b15170
Thread    C:\windows\system32\svchost.exe [1124:3292]                                                      000007fef91f5124
Thread    C:\windows\system32\WLANExt.exe [1360:1428]                                                      000000018000b674
Thread    C:\windows\system32\WLANExt.exe [1360:1432]                                                      000000018000b690
Thread    C:\windows\system32\WLANExt.exe [1360:1436]                                                      000000018000b658
Thread    C:\windows\system32\WLANExt.exe [1360:1440]                                                      0000000180022170
Thread    C:\windows\system32\WLANExt.exe [1360:1444]                                                      000007fef9b12f9c
Thread    C:\windows\System32\spoolsv.exe [1508:2436]                                                      000007fef82b10c8
Thread    C:\windows\System32\spoolsv.exe [1508:2440]                                                      000007fef8276144
Thread    C:\windows\System32\spoolsv.exe [1508:2444]                                                      000007fef8065fd0
Thread    C:\windows\System32\spoolsv.exe [1508:2456]                                                      000007fef8053438
Thread    C:\windows\System32\spoolsv.exe [1508:2472]                                                      000007fef80663ec
Thread    C:\windows\System32\spoolsv.exe [1508:2508]                                                      000007fef83b5e5c
Thread    C:\windows\System32\spoolsv.exe [1508:2516]                                                      000007fef83e5074
Thread    C:\windows\System32\spoolsv.exe [1508:2716]                                                      000007fef8452288
Thread    C:\windows\System32\spoolsv.exe [1508:2740]                                                      000007fef8308760
Thread    C:\windows\system32\svchost.exe [1584:1620]                                                      000007fefcf71a70
Thread    C:\windows\system32\svchost.exe [1584:1644]                                                      000007fefcf71a70
Thread    C:\windows\system32\svchost.exe [1584:1656]                                                      000007fefcf71a70
Thread    C:\windows\system32\svchost.exe [1584:1664]                                                      000007fef98d2c70
Thread    C:\windows\system32\svchost.exe [1584:1680]                                                      000007fef98dfb40
Thread    C:\windows\system32\svchost.exe [1584:1696]                                                      000007fef98f1d20
Thread    C:\windows\system32\svchost.exe [1584:1700]                                                      000007fef98df6f0
Thread    C:\windows\system32\svchost.exe [1584:1768]                                                      000007fef97735c0
Thread    C:\windows\system32\svchost.exe [1584:2868]                                                      000007fef9775600
Thread    C:\windows\system32\svchost.exe [1584:3004]                                                      000007fef7822940
Thread    C:\windows\system32\svchost.exe [1584:3332]                                                      000007fef6aa2888
Thread    C:\windows\system32\svchost.exe [3492:3508]                                                      000007fef8065fd0
Thread    C:\windows\system32\svchost.exe [3492:3516]                                                      000007fef8053438
Thread    C:\windows\system32\svchost.exe [3492:3520]                                                      000007fef80663ec
Thread    C:\windows\system32\svchost.exe [3492:956]                                                       000007fefb8f2a7c

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde6900d4                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0ca9444b1a5                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0ca9444b1a5@90c115a1ee25         0x9E 0x77 0x23 0x06 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde6900d4 (not active ControlSet)  
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0ca9444b1a5 (not active ControlSet)  
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0ca9444b1a5@90c115a1ee25             0x9E 0x77 0x23 0x06 ...

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                            unknown MBR code

---- EOF - GMER 2.1 ----