malwarebytes findet 118 Schädlinge

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-04 12:10:13
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 596,17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\SEBAST~2\AppData\Local\Temp\kglyauoc.sys


---- User IAT/EAT - GMER 2.1 ----

IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!memcpy]                         [85486575ffc78308] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!_amsg_exit]                     [58d480189480000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!free]                           [10418948000063b4] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!_initterm]                      [48000063c1058d48] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!malloc]                         [63d6058d48184189] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!_XcptFilter]                    [8d48204189480000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!memmove]                        [418948000063e305] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[msvcrt.dll!memset]                         [c9854840498b4828] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[ntdll.dll!RtlCaptureContext]               [5f6015ff0000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[ntdll.dll!RtlLookupFunctionEntry]          [60e615ff504b8d48] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[ntdll.dll!RtlVirtualUnwind]                [bd15ffcb8b480000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!Sleep]                        [8d4820ec83485340] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!TerminateProcess]             [c515ff000064630d] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetSystemTimeAsFileTime]      [8548d88b48000060] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetCurrentProcessId]          [38244c8d4c6374c0] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetCurrentThreadId]           [4100008fd9158d48] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetTickCount]                 [c88b4800000003b8] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!QueryPerformanceCounter]      [c085000061da15ff] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CreateThread]                 [4c3824548b484478] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CancelIo]                     [48c933454024448d] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CreateIoCompletionPort]       [62f015ffcb8b] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!DeviceIoControl]              [244c8b482a78c085] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!PostQueuedCompletionStatus]   [8d4c30244c8d4c40] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!DefineDosDeviceA]             [641e158d48482444] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!SetUnhandledExceptionFilter]  [85000059e3e80000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!UnhandledExceptionFilter]     [4824448b480b74c0] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!WaitForSingleObject]          [c03302eb0a40b70f] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!SetEvent]                     [ccccc35b20c48348] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CreateEventA]                 [245c8948c3c03300] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!LocalAlloc]                   [2d158d48d98b48f8] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CloseHandle]                  [5949e8ce8b4800] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!LocalFree]                    [158d482474c08500] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!CreateFileA]                  [10b84100006524] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetQueuedCompletionStatus]    [5930e8ce8b480000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!WideCharToMultiByte]          [83480b74c0850000] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!DisableThreadLibraryCalls]    [eb80004002b80027] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!MultiByteToWideChar]          [30245c8b48c03301] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!lstrlenW]                     [c483483824748b48] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetLastError]                 [245c8948ccc35f20] 
IAT  C:\windows\system32\svchost.exe[4304] @ C:\windows\system32\kmddsp.tsp[KERNEL32.dll!GetCurrentProcess]            [8b4820ec83485708] 

---- EOF - GMER 2.1 ----
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Sebastian Marhofer (administrator) on SEBASTIAN-PC on 04-10-2013 10:55:25
Running from C:\Users\Sebastian Marhofer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe
(Microsoft Corporation) C:\windows\SysWOW64\schtasks.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Wajam) C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
() C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Intel® Corporation) C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
({StringFileInfo_CompanyName}) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Program Files (x86)\SeeSimilar\BackgroundHost64.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_5_502_146_ActiveX.exe
() C:\Users\Sebastian Marhofer\Desktop\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11855976 2011-05-19] (Realtek Semiconductor)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-10-08] ()
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [NTRedirect] - C:\windows\SysWOW64\rundll32.exe  "C:\Users\Sebastian Marhofer\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe [87336 2010-09-20] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [888488 2011-09-08] ({StringFileInfo_CompanyName})
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Sebastian\...\Run: [ICQ] - "C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
HKU\Sebastian\...\Run: [ctfmon.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\vlojmb.dat,FG00 <===== ATTENTION
HKU\Sebastian\...\Run: [Otsoarzun] - C:\Users\Sebastian\AppData\Roaming\Anba\quvix.exe
AppInit_DLLs: C:\windows\system32\nvinitx.dll [226920 2011-05-04] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~3\bitguard\261694~1.246\{c16c1~1\bitguard.dll [2704352 2013-10-01] ()
Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
ShortcutTarget: msconfig.lnk -> C:\PROGRA~3\vlojmb.dat (No File)
Startup: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk
ShortcutTarget: Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)
Startup: C:\Users\Sebastian Marhofer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk
ShortcutTarget: Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/?rlz=1W4CHBB_deDE554
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF330C4DAB992CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=AE0578929C315DE7&affID=121963&tsp=4989
URLSearchHook: (No Name) - {D8278076-BC68-4484-9233-6E7F1628B56C} -  No File
StartMenuInternet: IEXPLORE.EXE - %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=AE0578929C315DE7&affID=121963&tsp=4989
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: holasearch Helper Object - {DFF9B2DA-EF99-4B26-83CB-7058299999D8} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\bh\holasearch.dll (holasearch.com)
BHO-x32: SeeSimilar - {F225A2E3-8EE1-4204-B7A0-F4C551578A87} - C:\Program Files (x86)\SeeSimilar\ScriptHost.dll (SeeSimilar.com)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Holasearch Toolbar - {C510DFFB-0AFE-484C-BA40-CED5B74C4EEF} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\holasearchTlbr.dll (holasearch.com)
Toolbar: HKCU -  No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [SeeSimilar@SeeSimilar.com] - C:\Users\Sebastian Marhofer\AppData\Roaming\Mozilla\Extensions\SeeSimilar@SeeSimilar.com
FF Extension: SeeSimilar - C:\Users\Sebastian Marhofer\AppData\Roaming\Mozilla\Extensions\SeeSimilar@SeeSimilar.com
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF Extension: No Name - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF HKCU\...\Firefox\Extensions: [SeeSimilar@SeeSimilar.com] - C:\Users\Sebastian Marhofer\AppData\Roaming\Mozilla\Extensions\SeeSimilar@SeeSimilar.com
FF Extension: SeeSimilar - C:\Users\Sebastian Marhofer\AppData\Roaming\Mozilla\Extensions\SeeSimilar@SeeSimilar.com

Chrome: 
=======
CHR Extension: (YouTube) - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Wajam) - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0
CHR Extension: (Word CaptureX Extension) - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf\1.1_0
CHR Extension: () - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pggagllhehfjjfgnfnfkjedjlmbchamf\1.0.0.5
CHR Extension: (Gmail) - C:\Users\SEBAST~2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [fagpjgjmoaccgkkpjeoinehnoaimnbla] - C:\Users\Sebastian Marhofer\AppData\Roaming\BabSolution\CR\hola.crx
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Sebastian Marhofer\AppData\Local\Wajam\Chrome\wajam.crx
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Sebastian Marhofer\AppData\Roaming\SeeSimilar\SeeSimilar.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 BitGuard; C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [3173856 2013-10-01] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] ()
R2 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-05-02] (Wajam)
U2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{5edf809a-66dc-1738-97f5-c857fce53589}\   \...\???\{5edf809a-66dc-1738-97f5-c857fce53589}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-05] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-08-18] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-08-18] (Windows (R) 2003 DDK 3790 provider)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-04 10:55 - 2013-10-04 10:55 - 00000000 ____D C:\FRST
2013-10-04 10:54 - 2013-10-04 10:54 - 01954124 _____ (Farbar) C:\Users\Sebastian Marhofer\Desktop\FRST64.exe
2013-10-04 10:53 - 2013-10-04 10:53 - 00050477 _____ C:\Users\Sebastian Marhofer\Desktop\Defogger.exe
2013-10-04 10:53 - 2013-10-04 10:53 - 00000498 _____ C:\Users\Sebastian Marhofer\Desktop\defogger_disable.log
2013-10-04 10:53 - 2013-10-04 10:53 - 00000000 _____ C:\Users\Sebastian Marhofer\defogger_reenable
2013-10-04 09:05 - 2013-10-04 09:05 - 00000000 ____D C:\ProgramData\Oracle
2013-10-04 09:04 - 2013-10-04 09:03 - 00868264 _____ (Oracle Corporation) C:\windows\SysWOW64\npDeployJava1.dll
2013-10-04 09:04 - 2013-10-04 09:03 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-10-04 09:04 - 2013-10-04 09:03 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-10-04 09:04 - 2013-10-04 09:03 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-10-04 09:04 - 2013-10-04 09:03 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-04 09:03 - 2013-10-04 09:03 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-04 09:00 - 2013-10-04 09:00 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\Malwarebytes
2013-10-04 08:59 - 2013-10-04 08:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Sebastian Marhofer\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-04 08:59 - 2013-10-04 08:59 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-04 08:59 - 2013-10-04 08:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-04 08:59 - 2013-10-04 08:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-04 08:59 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-10-04 08:58 - 2013-10-04 10:51 - 00006984 _____ C:\windows\WindowsUpdate.log
2013-10-01 18:02 - 2013-10-01 18:02 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-22 17:52 - 2013-09-22 17:52 - 00000000 _____ C:\windows\SysWOW64\sho8F7C.tmp
2013-09-21 09:07 - 2013-09-21 09:07 - 98498750 _____ C:\windows\SysWOW64\ⳕ⨔蹬˜
2013-09-20 12:15 - 2013-09-20 12:15 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\File Scout
2013-09-14 11:34 - 2013-10-02 13:09 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-14 11:34 - 2013-09-14 11:34 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Local\avgchrome
2013-09-13 16:28 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-13 16:28 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-13 16:28 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-13 16:28 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-13 16:28 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-13 16:28 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-13 16:28 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-13 16:28 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-13 16:28 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-13 16:28 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-13 16:28 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-13 16:28 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-13 16:28 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-13 16:28 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-13 13:21 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-13 13:21 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-13 13:21 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-13 13:21 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-13 13:21 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-13 13:21 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-13 13:21 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-13 13:21 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-13 13:21 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-13 13:21 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-13 13:21 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-13 13:21 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-13 13:21 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-13 13:21 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-13 13:21 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-13 13:21 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-13 13:21 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-13 13:21 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-13 13:21 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-13 13:21 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-13 13:21 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-13 13:21 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 13:21 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-13 13:21 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-13 13:21 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-13 13:21 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-13 13:21 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll

==================== One Month Modified Files and Folders =======

2013-10-04 10:55 - 2013-10-04 10:55 - 00000000 ____D C:\FRST
2013-10-04 10:54 - 2013-10-04 10:54 - 01954124 _____ (Farbar) C:\Users\Sebastian Marhofer\Desktop\FRST64.exe
2013-10-04 10:53 - 2013-10-04 10:53 - 00050477 _____ C:\Users\Sebastian Marhofer\Desktop\Defogger.exe
2013-10-04 10:53 - 2013-10-04 10:53 - 00000498 _____ C:\Users\Sebastian Marhofer\Desktop\defogger_disable.log
2013-10-04 10:53 - 2013-10-04 10:53 - 00000000 _____ C:\Users\Sebastian Marhofer\defogger_reenable
2013-10-04 10:53 - 2013-07-10 16:40 - 00000000 ____D C:\Users\Sebastian Marhofer
2013-10-04 10:51 - 2013-10-04 08:58 - 00006984 _____ C:\windows\WindowsUpdate.log
2013-10-04 10:38 - 2013-08-07 15:15 - 00001134 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-04 09:23 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-04 09:23 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-04 09:15 - 2013-08-07 15:15 - 00001130 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-04 09:14 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-10-04 09:13 - 2011-09-27 09:45 - 00000000 ___RD C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-04 09:05 - 2013-10-04 09:05 - 00000000 ____D C:\ProgramData\Oracle
2013-10-04 09:03 - 2013-10-04 09:04 - 00868264 _____ (Oracle Corporation) C:\windows\SysWOW64\npDeployJava1.dll
2013-10-04 09:03 - 2013-10-04 09:04 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-10-04 09:03 - 2013-10-04 09:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-10-04 09:03 - 2013-10-04 09:04 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-10-04 09:03 - 2013-10-04 09:04 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-04 09:03 - 2013-10-04 09:03 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-04 09:03 - 2011-10-01 21:36 - 00790440 _____ (Oracle Corporation) C:\windows\SysWOW64\deployJava1.dll
2013-10-04 09:00 - 2013-10-04 09:00 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\Malwarebytes
2013-10-04 08:59 - 2013-10-04 08:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Sebastian Marhofer\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-04 08:59 - 2013-10-04 08:59 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-04 08:59 - 2013-10-04 08:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-04 08:59 - 2013-10-04 08:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-04 08:55 - 2013-07-11 17:33 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Local\CrashDumps
2013-10-04 08:54 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-10-02 16:15 - 2011-06-09 23:38 - 00654852 _____ C:\windows\system32\perfh007.dat
2013-10-02 16:15 - 2011-06-09 23:38 - 00130434 _____ C:\windows\system32\perfc007.dat
2013-10-02 16:15 - 2009-07-14 07:13 - 01500104 _____ C:\windows\system32\PerfStringBackup.INI
2013-10-02 13:09 - 2013-09-14 11:34 - 00000000 ____D C:\ProgramData\BitGuard
2013-10-01 18:02 - 2013-10-01 18:02 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-28 20:26 - 2013-07-10 16:43 - 00000000 ____D C:\Users\Sebastian Marhofer\Desktop\Sebastian
2013-09-27 18:39 - 2013-08-22 20:54 - 00000000 _____ C:\end
2013-09-22 17:52 - 2013-09-22 17:52 - 00000000 _____ C:\windows\SysWOW64\sho8F7C.tmp
2013-09-21 09:07 - 2013-09-21 09:07 - 98498750 _____ C:\windows\SysWOW64\ⳕ⨔蹬˜
2013-09-20 12:15 - 2013-09-20 12:15 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Roaming\File Scout
2013-09-19 18:55 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-09-18 18:20 - 2013-01-12 18:51 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-18 18:18 - 2013-07-10 16:54 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Local\Google
2013-09-14 11:34 - 2013-09-14 11:34 - 00000000 ____D C:\Users\Sebastian Marhofer\AppData\Local\avgchrome
2013-09-13 18:06 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-09-13 16:33 - 2013-07-10 16:40 - 00000000 ___RD C:\Users\Sebastian Marhofer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 16:33 - 2013-07-10 16:40 - 00000000 ___RD C:\Users\Sebastian Marhofer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 16:32 - 2009-07-14 06:45 - 00277648 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-13 16:27 - 2013-07-23 13:02 - 00000000 ____D C:\windows\system32\MRT
2013-09-13 16:27 - 2011-10-24 16:30 - 01527912 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2013-09-13 16:27 - 2011-10-24 16:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 16:25 - 2011-10-03 14:10 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-2363513811-1566349318-2052125673-1001\$5edf809a66dc173897f5c857fce53589

Files to move or delete:
====================
ZeroAccess:
C:\Users\Sebastian Marhofer\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install
C:\ProgramData\bmjolv.bat
C:\ProgramData\bmjolv.pad
C:\ProgramData\bmjolv.reg
C:\ProgramData\eqt9l.pad
C:\ProgramData\ras_0oed.pad
C:\ProgramData\w0wi2v.dat
C:\Users\Public\AlexaNSISPlugin.6312.dll
C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk


Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\AskSLib.dll
C:\Users\Sebastian\AppData\Local\Temp\contentDATs.exe
C:\Users\Sebastian\AppData\Local\Temp\ffdyyhmcdrodiyynx.exe
C:\Users\Sebastian\AppData\Local\Temp\FP_PL_PFS_INSTALLER-1.exe
C:\Users\Sebastian\AppData\Local\Temp\FP_PL_PFS_INSTALLER-2.exe
C:\Users\Sebastian\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Sebastian\AppData\Local\Temp\i4jdel0.exe
C:\Users\Sebastian\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Sebastian\AppData\Local\Temp\iupdate.exe
C:\Users\Sebastian\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Sebastian\AppData\Local\Temp\setup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender


LastRegBack: 2013-09-24 15:12

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013
Ran by Sebastian Marhofer at 2013-10-04 10:57:30
Running from C:\Users\Sebastian Marhofer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Out of date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Out of date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

„Windows Live Essentials“ (x32 Version: 15.4.3502.0922)
„Windows Live Mail“ (x32 Version: 15.4.3502.0922)
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922)
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922)
Adobe Flash Player 10 Plugin (x32 Version: 10.3.183.10)
Adobe Flash Player 11 ActiveX (x32 Version: 11.5.502.146)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Ask Toolbar (x32 Version: 1.14.1.0)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
BatteryLifeExtender (x32 Version: 1.0.11)
Bing Bar (x32 Version: 7.0.610.0)
BitGuard (x32)
ChargeableUSB (x32 Version: 1.0.0.0)
CyberLink Media Suite (x32 Version: 8.0.2227)
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00)
CyberLink MediaShow (x32 Version: 5.0.1130a)
CyberLink Power2Go (x32 Version: 6.1.3802)
CyberLink PowerDirector (x32 Version: 8.0.3306)
CyberLink YouCam (x32 Version: 3.1.3509)
D3DX10 (x32 Version: 15.4.2368.0902)
Easy Content Share (x32 Version: 1.0)
Easy Display Manager (x32 Version: 3.2)
Easy Migration (x32 Version: 1.0)
Easy Network Manager (x32 Version: 4.4.7)
EasyBatteryManager (x32 Version: 4.0.0.4)
EasyFileShare (x32 Version: 1.0.11)
ETDWare PS/2-X64 10.7.14.12_WHQL (Version: 10.7.14.12)
Fast Start (x32 Version: 2.2.0.0)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
FreePDF (Remove only) (x32)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Ghost Town Mysteries (x32)
Google Chrome (x32 Version: 29.0.1547.76)
Google Update Helper (x32 Version: 1.3.21.153)
hola Chrome Toolbar (x32)
holasearch toolbar   (x32 Version: 1.8.16.16)
Intel PROSet Wireless
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2462)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
Intel® PROSet/Wireless WiFi-Software (Version: 15.00.0000.0642)
Java 7 Update 40 (x32 Version: 7.0.400)
Java Auto Updater (x32 Version: 2.1.9.8)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
NVIDIA Control Panel 266.72 (Version: 266.72)
NVIDIA Graphics Driver 266.72 (Version: 266.72)
NVIDIA Install Application (Version: 2.265.39.0)
NVIDIA Optimus 1.0.15 (Version: 1.0.15)
NVIDIA PhysX (x32 Version: 9.09.0203)
NVIDIA Update Components (Version: 1.0.15)
PhoneShare (x32 Version: 9.1.4)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller Driver (x32 Version: 7.44.421.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6378)
RedMon - Redirection Port Monitor
Samsung AnyWeb Print (x32 Version: 2.0.67.1)
Samsung Printer Live Update (x32)
Samsung Recovery Solution 5 (x32 Version: 5.0.0.9)
Samsung Support Center (x32 Version: 1.1.24)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0)
Samsung Update Plus (x32 Version: 3.0.0.17)
SeeSimilar (x32 Version: 1.0.0.5)
Skype™ 5.10 (x32 Version: 5.10.116)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
User Guide (x32 Version: 1.5)
Wajam (x32 Version: 1.81)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live fotoattēlu galerija (x32 Version: 15.4.3502.0922)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Foto-galerija (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Pošta (x32 Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 메일 (x32 Version: 15.4.3502.0922)
Windows Live 사진 갤러리 (x32 Version: 15.4.3502.0922)
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922)
Windows Live 影像中心 (x32 Version: 15.4.3502.0922)
Windows Live 照片库 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3508.1109)
Windows Live 软件包 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WordCaptureX Pro (x32 Version: 4.0.0)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
معرض صور Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

16-09-2013 16:24:32 Windows-Sicherung
22-09-2013 17:17:00 Windows-Sicherung
26-09-2013 10:44:50 Windows-Sicherung
01-10-2013 15:12:36 Windows-Sicherung
04-10-2013 07:01:41 Removed Java(TM) 6 Update 27
04-10-2013 07:03:30 Installed Java 7 Update 40

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0ED2D85F-8AFE-48BE-BC64-DD8B3E06F3E2} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {17361776-632D-4246-AADE-9680C889C337} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe
Task: {2DCC06A5-9A86-4561-B040-20B6A56F1406} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {36AE324A-DAEA-4967-A52D-B2DD990FA0F1} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
Task: {415FF63B-7725-4FE9-BFA4-AE154E954C33} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {451203D1-3AEA-4306-BC57-D55C6A26F43B} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {4A0D2E26-72B1-45D8-AD33-FA495FD26FE7} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {4D5F2877-5AEC-4D34-B382-20CD663996B1} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-01-12] (Samsung Electronics)
Task: {623155BC-5B06-408E-9C2C-AF88FEA776C0} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {630B8858-0F3B-4B7F-9B88-1B8F3BD8CCB6} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {695528EF-8AB9-41ED-AEC7-E45416A4E351} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-07] (Google Inc.)
Task: {7380DC84-7DF0-4D6E-85FA-23C91803DAE0} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {806DFA49-FF8B-401F-AB10-C76DF1301230} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {82669EE7-D9ED-4C82-86B9-0B88C681AF93} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {88382C5B-16AE-4D1D-A7BA-6433AB344D95} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {BCDC72EA-130B-475F-8789-E61E903E66F2} - System32\Tasks\EPUpdater => C:\Users\Sebastian Marhofer\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-08-04] ()
Task: {FC521D09-6F7D-49BD-B196-E59954EBE957} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-07] (Google Inc.)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-06-09 23:17 - 2010-12-17 03:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-10-08 02:27 - 2010-10-08 02:27 - 01600000 _____ () C:\Program Files\Intel\TurboBoost\de\SignalIslandUi.resources.dll
2013-08-05 17:57 - 2013-08-05 17:42 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-10-01 18:02 - 2013-10-01 11:46 - 02704352 _____ () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll
2011-06-09 08:37 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2013-09-01 13:09 - 2013-08-22 12:02 - 00187888 _____ () C:\Users\Sebastian Marhofer\AppData\Roaming\BabSolution\Shared\enhancedNT.dll
2009-11-02 07:20 - 2009-11-02 07:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 07:23 - 2009-11-02 07:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2011-06-09 08:35 - 2010-05-07 16:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:225CD7D5

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/04/2013 09:25:00 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (10/04/2013 09:17:34 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (10/04/2013 09:17:02 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (10/04/2013 09:16:19 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:59:05 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/04/2013 08:57:57 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (10/04/2013 08:57:42 AM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.16686 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fb0

Startzeit: 01cec0ced5b80c2c

Endzeit: 15

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (10/04/2013 08:57:26 AM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (10/04/2013 08:55:38 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:54:43 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0xf00
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3


System errors:
=============
Error: (10/04/2013 10:51:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/04/2013 10:51:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/04/2013 09:17:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/04/2013 09:17:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891

Error: (10/04/2013 09:14:47 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1060

Error: (10/04/2013 09:14:46 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (10/04/2013 08:56:53 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Benutzerprofildienst" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (10/04/2013 08:56:22 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (10/04/2013 08:55:26 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2147024891

Error: (10/04/2013 08:55:26 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147024891


Microsoft Office Sessions:
=========================
Error: (10/04/2013 09:25:00 AM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (10/04/2013 09:17:34 AM) (Source: CVHSVC)(User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (10/04/2013 09:17:02 AM) (Source: CVHSVC)(User: )
Description: Too many failures while downloading ranges: 2

Error: (10/04/2013 09:16:19 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:59:05 AM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Sebastian Marhofer\Downloads\SoftonicDownloader_fuer_freepdf.exe

Error: (10/04/2013 08:57:57 AM) (Source: CVHSVC)(User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (10/04/2013 08:57:42 AM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE10.0.9200.16686fb001cec0ced5b80c2c15C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (10/04/2013 08:57:26 AM) (Source: CVHSVC)(User: )
Description: Too many failures while downloading ranges: 2

Error: (10/04/2013 08:55:38 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2013 08:54:43 AM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487f0001cec0ce90f9fbfcC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exed894c481-2cc1-11e3-aee3-e811329b87aa


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 4008.29 MB
Available physical RAM: 2362.91 MB
Total Pagefile: 8014.76 MB
Available Pagefile: 5081.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:150 GB) (Free:37.95 GB) NTFS
Drive d: () (Fixed) (Total:423.24 GB) (Free:402.59 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 1F8D46A3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=150 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=423 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23 GB) - (Type=27)

==================== End Of Log ============================