PUP optional/iminent Befall und das Internet lhmt

Miro3

Hallo, liebes Forum!

Ich brauche wohl Hilfe ...
Nutze Win 8, 64-Bit und Internet+Telefonie 100 von Kabel Deutschland sowie Kaspersky Internet Security
Folgendes ist geschehen ....
....ich habe mir diesen lästigen PUP Optional Iminent eingefangen, leider erst 2 Tage später bemerkt, als meine gmx und web.de Accounts
aufgrund zu häufiger falscher Paßwort-Eingabe gesperrt waren; daß das Internet sehr langsam geworden war,
hatte ich noch mit dem 48 stündigem Komplettausfall zuvor durch den Sturm in Verbindung gebracht.

Weitere Anzeichen :
-Internet-Radio streamen ging gar nicht, lud ewig ohne zu öffnen
-Anzeige "Chat nicht verbunden" bei Facebook
-maximal 47.000 kbits im Download, wenn ich dann mal messen konnte - sämtliche Speedtester öffneten nicht bis selten
-im Mittel 31.000 kbits
-Zugriff auf Emails war nach Fristablauf wieder möglich
-interessanterweise geht der Speedtest von KD zwar, zeigt aber statt einem Ergebnis Werbung für deren Tarife an.
- in den Email Konten sonst alles ruhig, bis auf einige Spams, die meine Bankkarten suspendieren, haha....

Malwarebytes AntiMalware hat ihn dann entdeckt, insgesamt 233 Dateien und gelöscht.

Problem: Internet lahmte weiter, KD prüfte Leitugen - alles ok laut dem Service, Modem geresettet, eine Stunde vom Netz genommen und auch in
Modemseite geschaut - ohne Befund !
Habe dann diese schicke "Alles entfernen und Windows neu aufsetzen"-Feature genutzt.
Nochmals Malwarebytes laufen lassen, nochmals 2 Dateien gefunden und gelöscht.
Seitenaufbau klappt jetzt schon besser, teilweise immer noch Probleme und noch immer max. 47.000 kbits, mit Betonung auf maximal.
Habe jetzt insgesamt drüberlaufen lassen.....
....Kaspersky, Avast, Bitdefender, AdwCleaner, JunkwareRemovalTool, Farber Recovery Scan Tool, Eset Online Scanner, defogger,
Trend Micro Housecall, Gmer und Virus Total.
Es scheint nichts mehr gefunden zu werden, aber das Internet lahmt noch immer.
Grrrrrr.
An dieser Stelle wäre ich für etwas Support sehr dankbar - wie soll ich fortfahren?
Vielen Dank schon einmal im Voraus .

Leider sind mir die ersten Logs im Eifer des Gefechts beim Plätten verlorengegangen, sehr nachlässig - ich weiß, aber ist ist leider oder zum Glück
mein erster Virus/Trojaner.
Grad nochmal Speedtest unter www.wieistmeineip.de - 47.000 kbits unter Wlan, aber zu früh gefreut, LAN eingestöpselt und die Seite öffnet nicht ....
Im Folgenden die Logs nach dem Neuaufsetzen .....




Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Miro3 at 2013-11-06 17:47:38
Running from C:\Users\Miro3\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Kaspersky Internet Security (Enabled - Up to date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}

==================== Installed Programs ======================

ArcSoft TV 5.0 (x32 Version: 5.0.8.145)
Ashampoo AppLauncher (Medion) v.1.0.0 (x32 Version: 1.0.0)
CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3111_44883)
CyberLink PhotoDirector 3 (x32 Version: 3.0.3124)
CyberLink PhotoNow (x32 Version: 1.1.7717)
CyberLink Power2Go 8 (x32 Version: 8.0.0.1920)
CyberLink PowerDirector (Version: 9.0.0.3815c)
CyberLink PowerDVD 10 (x32 Version: 10.0.4125.02)
CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.2715b)
CyberLink PowerRecover (Version: 5.7.0.0913)
CyberLink PowerRecover (x32 Version: 5.7.0.0913)
CyberLink YouCam 5 (x32 Version: 5.0.1930)
D3DX10 (x32 Version: 15.4.2368.0902)
Dolby Home Theater v4 (x32 Version: 7.2.8000.17)
Fotogalerie (x32 Version: 16.4.3505.0912)
Fotogalerija (x32 Version: 16.4.3505.0912)
Fotótár (x32 Version: 16.4.3505.0912)
Galería de fotos (x32 Version: 16.4.3505.0912)
Galerie de photos (x32 Version: 16.4.3505.0912)
Intel PROSet Wireless
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2875)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.5.4.0423)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.6.1210.0278)
Intel(R) Rapid Storage Technology (x32 Version: 11.6.0.1030)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)
Intel(R) WiDi (Version: 3.5.40.0)
Intel® PROSet/Wireless WiFi Software (Version: 15.05.6000.1620)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
IT9130 Driver v12.2.3.1 (x32)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mediathek (x32 Version: 1.4.0)
Medion Home Cinema 10 (x32 Version: 10.0)
Medion Home Cinema 10 (x32 Version: 10.1924)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office (x32 Version: 14.0.6120.5004)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3505.0912)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
NVIDIA Control Panel 307.17 (Version: 307.17)
NVIDIA Graphics Driver 307.17 (Version: 307.17)
NVIDIA Install Application (Version: 2.1002.85.551)
NVIDIA Optimus 1.10.8 (Version: 1.10.8)
NVIDIA Update Components (Version: 1.10.8)
PHotkey (x32 Version: 1.00.0081)
Photo Common (x32 Version: 16.4.3505.0912)
Photo Gallery (x32 Version: 16.4.3505.0912)
QuickLaunch (x32 Version: 1.00.0019)
Raccolta foto (x32 Version: 16.4.3505.0912)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6722)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136)
Synaptics Pointing Device Driver (Version: 16.2.12.12)
Windows Live (x32 Version: 16.4.3505.0912)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)

==================== Restore Points =========================

05-11-2013 23:55:43 Sprachpaketdeinstallation

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0E22486E-BD76-4AB8-82D9-FF0499C69DC1} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {44149F67-C153-475E-B1A9-D09A6EC70ACF} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation)
Task: {5E4D3901-C47F-495E-8771-679433B59FF6} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-09-05] (Synaptics Incorporated)
Task: {AB96B97B-39C2-46A2-876A-EEB6AE199033} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup => C:\Windows\System32\Dism.exe [2012-07-26] (Microsoft Corporation)
Task: {DF363859-5169-4663-9CE9-1DEC3107A8C1} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\Windows\System32\oobe\setupsqm.exe [2012-07-26] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) =============

2012-11-14 09:03 - 2012-10-22 18:39 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-17 22:39 - 2013-11-05 22:41 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
2012-11-14 09:27 - 2012-11-14 09:27 - 00017920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\2a87eb344d4aa5ad4e8360d799271e32\PSIClient.ni.dll
2012-11-14 09:20 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-11-29 14:32 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-11-29 14:32 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2012-11-21 16:23 - 2007-04-19 10:33 - 00035584 _____ () C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\uPiApi.dll
2012-11-21 16:23 - 2012-06-04 16:50 - 00016384 _____ () C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\uTVMUIEngine.dll
2012-11-14 08:43 - 2012-06-08 04:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 12:34 - 2012-06-08 12:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2012-08-17 22:38 - 2012-08-17 22:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2012-08-17 22:40 - 2012-08-17 22:40 - 00068024 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtWebKit\qmlwebkitplugin4.dll

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/06/2013 03:10:54 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.

Error: (11/06/2013 03:10:46 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.

Error: (11/06/2013 02:39:43 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005

Error: (11/05/2013 11:20:40 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.

Error: (11/05/2013 11:20:37 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.

Error: (11/05/2013 11:20:34 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.

Error: (11/05/2013 11:20:34 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifest.


System errors:
=============
Error: (11/05/2013 11:21:10 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: {A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (11/05/2013 11:20:45 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "LoadUserProfile" ist aufgrund folgenden Fehlers fehlgeschlagen:
%%21

Error: (11/05/2013 11:19:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Network List Service" wurde mit folgendem Fehler beendet:
%%21

Error: (11/05/2013 11:19:10 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: {A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (11/05/2013 11:17:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet:
%%2147770990

Error: (11/05/2013 11:17:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Network List Service" wurde mit folgendem Fehler beendet:
%%21

Error: (11/05/2013 11:17:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IP Helper" wurde mit folgendem Fehler beendet:
%%1058

Error: (11/05/2013 11:15:44 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (11/29/2012 02:48:48 PM) (Source: DCOM) (User: )
Description: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}


Microsoft Office Sessions:
=========================
Error: (11/06/2013 03:10:54 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\Downloads\esetsmartinstaller_enu.exe

Error: (11/06/2013 03:10:46 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\Downloads\esetsmartinstaller_enu.exe

Error: (11/06/2013 02:39:43 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005

Error: (11/05/2013 11:20:40 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOY372PV\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe

Error: (11/05/2013 11:20:37 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOY372PV\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe

Error: (11/05/2013 11:20:34 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOY372PV\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe

Error: (11/05/2013 11:20:34 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_418c2a697189c07f.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16384_none_893961408605e985.manifestC:\Users\Miro3\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOY372PV\SoftonicDownloader_fuer_malwarebytes-anti-malware.exe


==================== Memory info ===========================

Percentage of memory in use: 32%
Total physical RAM: 8072.9 MB
Available physical RAM: 5429.75 MB
Total Pagefile: 12680.9 MB
Available Pagefile: 9751.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.76 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:827.51 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:40.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 462A80D0)

Partition: GPT Partition Type
==================== End Of Log ============================




Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Miro3 (administrator) on Miros-Pc on 06-11-2013 17:47:03
Running from C:\Users\Miro3\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files (x86)\PHotkey\ATouch64.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\POSD.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\klwtblfs.exe
() C:\Users\Miro3\Downloads\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] - C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\runner_avp.exe [24504 2012-10-04] (Kaspersky Lab ZAO)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [247144 2012-10-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203112 2012-10-11] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKCU - DefaultScope {A98C4DFA-FCB2-4050-A74B-FB01AC04C456} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - {A98C4DFA-FCB2-4050-A74B-FB01AC04C456} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-11-05] (Kaspersky Lab ZAO)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [15440 2012-07-26] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132480 2012-10-01] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-11-05] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2013-11-05] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2013-11-05] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-11-05] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [50448 2013-11-05] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178448 2013-11-05] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [4309032 2012-10-10] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-11-05] (Kaspersky Lab ZAO)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-06 17:46 - 2013-11-06 17:46 - 01957098 _____ (Farbar) C:\Users\Miro3\Downloads\FRST64.exe
2013-11-06 17:46 - 2013-11-06 17:46 - 00000000 ____D C:\FRST
2013-11-06 17:24 - 2013-11-06 17:43 - 00000472 _____ C:\Users\Miro3\Desktop\defogger_disable.log
2013-11-06 17:24 - 2013-11-06 17:24 - 00000000 _____ C:\Users\Miro3\defogger_reenable
2013-11-06 17:23 - 2013-11-06 17:23 - 00050477 _____ C:\Users\Miro3\Downloads\Defogger.exe
2013-11-06 15:10 - 2013-11-06 15:10 - 02347384 _____ (ESET) C:\Users\Miro3\Downloads\esetsmartinstaller_enu.exe
2013-11-06 10:55 - 2013-11-06 10:55 - 00266803 _____ C:\Users\Miro3\AppData\Local\census.cache
2013-11-06 10:55 - 2013-11-06 10:55 - 00109154 _____ C:\Users\Miro3\AppData\Local\ars.cache
2013-11-06 10:32 - 2013-11-06 10:32 - 00000036 _____ C:\Users\Miro3\AppData\Local\housecall.guid.cache
2013-11-06 10:12 - 2013-11-06 10:12 - 00000688 _____ C:\Users\Miro3\Desktop\JRT.txt
2013-11-06 09:59 - 2013-11-06 09:59 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:56 - 2013-11-06 08:56 - 00001344 _____ C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013.lnk
2013-11-05 23:22 - 2013-11-05 23:22 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Malwarebytes
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-05 23:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-05 23:21 - 2013-11-05 23:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Miro3\Desktop\mbam-setup-1-75-0-1300.exe
2013-11-05 23:16 - 2013-11-05 23:16 - 00002324 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-424742948-590344693-1656857337-500
2013-11-05 23:15 - 2013-11-05 23:15 - 00000000 _____ C:\Recovery.txt
2013-11-05 22:46 - 2013-11-05 22:46 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Macromedia
2013-11-05 22:43 - 2013-11-06 14:13 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-424742948-590344693-1656857337-1002
2013-11-05 22:39 - 2013-11-06 08:56 - 00000000 ____D C:\Users\Miro3\Documents\Youcam
2013-11-05 22:39 - 2013-11-05 22:39 - 00000000 ____D C:\Users\Miro3\AppData\Local\CyberLink
2013-11-05 22:38 - 2013-11-05 22:38 - 00002344 _____ C:\Users\Miro3\Desktop\Sicherer Zahlungsverkehr.lnk
2013-11-05 22:38 - 2013-11-05 22:38 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\ArcSoft
2013-11-05 22:38 - 2013-11-05 22:38 - 00000000 ____D C:\Users\Miro3\AppData\Local\Power2Go8
2013-11-05 22:37 - 2013-11-05 22:37 - 00001442 _____ C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Adobe
2013-11-05 22:37 - 2012-11-18 03:22 - 00001711 _____ C:\Users\Miro3\Desktop\Kindersicherung einrichten.lnk
2013-11-05 22:37 - 2012-11-18 03:22 - 00001711 _____ C:\Users\Default\Desktop\Kindersicherung einrichten.lnk
2013-11-05 22:37 - 2012-11-18 03:22 - 00001711 _____ C:\Users\Default User\Desktop\Kindersicherung einrichten.lnk
2013-11-05 22:37 - 2012-09-20 21:16 - 00001851 _____ C:\Users\Public\Desktop\eBay.lnk
2013-11-05 22:37 - 2012-08-10 22:25 - 00001193 _____ C:\Users\Miro3\Desktop\ALDI Foto.lnk
2013-11-05 22:37 - 2012-08-10 22:25 - 00001193 _____ C:\Users\Default\Desktop\ALDI Foto.lnk
2013-11-05 22:37 - 2012-08-10 22:25 - 00001193 _____ C:\Users\Default User\Desktop\ALDI Foto.lnk
2013-11-05 22:37 - 2012-08-10 22:20 - 00001251 _____ C:\Users\Miro3\Desktop\Medion Services.lnk
2013-11-05 22:37 - 2012-08-10 22:20 - 00001251 _____ C:\Users\Default\Desktop\Medion Services.lnk
2013-11-05 22:37 - 2012-08-10 22:20 - 00001251 _____ C:\Users\Default User\Desktop\Medion Services.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001809 _____ C:\Users\Miro3\Desktop\ALDI Talk.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001809 _____ C:\Users\Default\Desktop\ALDI Talk.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001809 _____ C:\Users\Default User\Desktop\ALDI Talk.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001093 _____ C:\Users\Miro3\Desktop\ALDI Nord Reisen.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001093 _____ C:\Users\Default\Desktop\ALDI Nord Reisen.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001093 _____ C:\Users\Default User\Desktop\ALDI Nord Reisen.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001037 _____ C:\Users\Miro3\Desktop\ALDI Nord Startseite.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001037 _____ C:\Users\Default\Desktop\ALDI Nord Startseite.lnk
2013-11-05 22:37 - 2012-08-05 06:08 - 00001037 _____ C:\Users\Default User\Desktop\ALDI Nord Startseite.lnk
2013-11-05 22:37 - 2012-08-05 05:39 - 00001893 _____ C:\Users\Miro3\Desktop\ALDI Nord Blumen Service.lnk
2013-11-05 22:37 - 2012-08-05 05:39 - 00001893 _____ C:\Users\Default\Desktop\ALDI Nord Blumen Service.lnk
2013-11-05 22:37 - 2012-08-05 05:39 - 00001893 _____ C:\Users\Default User\Desktop\ALDI Nord Blumen Service.lnk
2013-11-05 22:36 - 2013-11-05 22:37 - 00000000 ____D C:\Users\Miro3\AppData\Local\Packages
2013-11-05 22:36 - 2013-11-05 22:36 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Intel
2013-11-05 22:36 - 2013-11-05 22:36 - 00000000 ____D C:\Users\Miro3\AppData\Local\VirtualStore
2013-11-05 22:35 - 2013-11-06 17:40 - 00350742 _____ C:\Windows\WindowsUpdate.log
2013-11-05 22:35 - 2013-11-06 17:24 - 00000000 ____D C:\Users\Miro3
2013-11-05 22:35 - 2013-11-05 22:35 - 00000020 ___SH C:\Users\Miro3\ntuser.ini
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Vorlagen
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Startmenü
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Netzwerkumgebung
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Lokale Einstellungen
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Eigene Dateien
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Druckumgebung
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Documents\Eigene Musik
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Documents\Eigene Bilder
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Local\Verlauf
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Local\Anwendungsdaten
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Anwendungsdaten
2013-11-05 22:35 - 2012-07-26 09:13 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2013-11-05 22:35 - 2012-07-26 09:13 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-05 22:35 - 2012-07-26 09:13 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2013-11-05 22:35 - 2012-07-26 09:13 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

2013-11-06 17:46 - 2013-11-06 17:46 - 01957098 _____ (Farbar) C:\Users\Miro3\Downloads\FRST64.exe
2013-11-06 17:46 - 2013-11-06 17:46 - 00000000 ____D C:\FRST
2013-11-06 17:43 - 2013-11-06 17:24 - 00000472 _____ C:\Users\Miro3\Desktop\defogger_disable.log
2013-11-06 17:40 - 2013-11-05 22:35 - 00350742 _____ C:\Windows\WindowsUpdate.log
2013-11-06 17:24 - 2013-11-06 17:24 - 00000000 _____ C:\Users\Miro3\defogger_reenable
2013-11-06 17:24 - 2013-11-05 22:35 - 00000000 ____D C:\Users\Miro3
2013-11-06 17:23 - 2013-11-06 17:23 - 00050477 _____ C:\Users\Miro3\Downloads\Defogger.exe
2013-11-06 17:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2013-11-06 16:59 - 2012-11-14 09:35 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-06 15:10 - 2013-11-06 15:10 - 02347384 _____ (ESET) C:\Users\Miro3\Downloads\esetsmartinstaller_enu.exe
2013-11-06 14:13 - 2013-11-05 22:43 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-424742948-590344693-1656857337-1002
2013-11-06 10:55 - 2013-11-06 10:55 - 00266803 _____ C:\Users\Miro3\AppData\Local\census.cache
2013-11-06 10:55 - 2013-11-06 10:55 - 00109154 _____ C:\Users\Miro3\AppData\Local\ars.cache
2013-11-06 10:32 - 2013-11-06 10:32 - 00000036 _____ C:\Users\Miro3\AppData\Local\housecall.guid.cache
2013-11-06 10:12 - 2013-11-06 10:12 - 00000688 _____ C:\Users\Miro3\Desktop\JRT.txt
2013-11-06 09:59 - 2013-11-06 09:59 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 09:27 - 2012-11-14 07:39 - 00786588 _____ C:\Windows\system32\perfh013.dat
2013-11-06 09:27 - 2012-11-14 07:39 - 00159122 _____ C:\Windows\system32\perfc013.dat
2013-11-06 09:27 - 2012-11-14 07:26 - 00782014 _____ C:\Windows\system32\perfh010.dat
2013-11-06 09:27 - 2012-11-14 07:26 - 00153144 _____ C:\Windows\system32\perfc010.dat
2013-11-06 09:27 - 2012-11-14 07:14 - 00731582 _____ C:\Windows\system32\perfh00E.dat
2013-11-06 09:27 - 2012-11-14 07:14 - 00174554 _____ C:\Windows\system32\perfc00E.dat
2013-11-06 09:27 - 2012-11-14 07:05 - 00791060 _____ C:\Windows\system32\perfh00C.dat
2013-11-06 09:27 - 2012-11-14 07:05 - 00155620 _____ C:\Windows\system32\perfc00C.dat
2013-11-06 09:27 - 2012-11-14 06:54 - 00788984 _____ C:\Windows\system32\perfh00A.dat
2013-11-06 09:27 - 2012-11-14 06:54 - 00162890 _____ C:\Windows\system32\perfc00A.dat
2013-11-06 09:27 - 2012-11-14 06:45 - 00754172 _____ C:\Windows\system32\perfh007.dat
2013-11-06 09:27 - 2012-11-14 06:45 - 00156362 _____ C:\Windows\system32\perfc007.dat
2013-11-06 09:27 - 2012-11-14 06:36 - 00456714 _____ C:\Windows\system32\perfh006.dat
2013-11-06 09:27 - 2012-11-14 06:36 - 00079958 _____ C:\Windows\system32\perfc006.dat
2013-11-06 09:27 - 2012-07-26 08:28 - 06967948 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 08:56 - 2013-11-06 08:56 - 00001344 _____ C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013.lnk
2013-11-06 08:56 - 2013-11-05 22:39 - 00000000 ____D C:\Users\Miro3\Documents\Youcam
2013-11-06 00:55 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\restore
2013-11-05 23:23 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-05 23:22 - 2013-11-05 23:22 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Malwarebytes
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-05 23:22 - 2013-11-05 23:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-05 23:22 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-11-05 23:21 - 2013-11-05 23:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Miro3\Desktop\mbam-setup-1-75-0-1300.exe
2013-11-05 23:17 - 2012-07-26 09:13 - 00006663 _____ C:\Windows\DtcInstall.log
2013-11-05 23:17 - 2012-07-26 08:21 - 00020663 _____ C:\Windows\setupact.log
2013-11-05 23:16 - 2013-11-05 23:16 - 00002324 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-424742948-590344693-1656857337-500
2013-11-05 23:15 - 2013-11-05 23:15 - 00000000 _____ C:\Recovery.txt
2013-11-05 23:15 - 2012-07-26 09:13 - 00262144 _____ C:\Windows\system32\config\BCD-Template
2013-11-05 23:15 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\Recovery
2013-11-05 22:49 - 2012-11-14 09:35 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-11-05 22:49 - 2012-11-14 09:35 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-11-05 22:49 - 2012-10-04 17:25 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2013-11-05 22:49 - 2012-10-04 17:25 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2013-11-05 22:49 - 2012-08-13 17:49 - 00178448 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2013-11-05 22:49 - 2012-08-03 16:55 - 00050448 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwfp.sys
2013-11-05 22:49 - 2012-06-19 18:28 - 07717984 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2013-11-05 22:46 - 2013-11-05 22:46 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Macromedia
2013-11-05 22:39 - 2013-11-05 22:39 - 00000000 ____D C:\Users\Miro3\AppData\Local\CyberLink
2013-11-05 22:38 - 2013-11-05 22:38 - 00002344 _____ C:\Users\Miro3\Desktop\Sicherer Zahlungsverkehr.lnk
2013-11-05 22:38 - 2013-11-05 22:38 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\ArcSoft
2013-11-05 22:38 - 2013-11-05 22:38 - 00000000 ____D C:\Users\Miro3\AppData\Local\Power2Go8
2013-11-05 22:37 - 2013-11-05 22:37 - 00001442 _____ C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ___RD C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-11-05 22:37 - 2013-11-05 22:37 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Adobe
2013-11-05 22:37 - 2013-11-05 22:36 - 00000000 ____D C:\Users\Miro3\AppData\Local\Packages
2013-11-05 22:37 - 2012-07-26 08:20 - 00000000 ____D C:\Windows\Setup
2013-11-05 22:36 - 2013-11-05 22:36 - 00000000 ____D C:\Users\Miro3\AppData\Roaming\Intel
2013-11-05 22:36 - 2013-11-05 22:36 - 00000000 ____D C:\Users\Miro3\AppData\Local\VirtualStore
2013-11-05 22:36 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2013-11-05 22:36 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-11-05 22:35 - 2013-11-05 22:35 - 00000020 ___SH C:\Users\Miro3\ntuser.ini
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Vorlagen
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Startmenü
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Netzwerkumgebung
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Lokale Einstellungen
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Eigene Dateien
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Druckumgebung
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Documents\Eigene Musik
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Documents\Eigene Bilder
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Local\Verlauf
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\AppData\Local\Anwendungsdaten
2013-11-05 22:35 - 2013-11-05 22:35 - 00000000 _SHDL C:\Users\Miro3\Anwendungsdaten
2013-11-05 22:35 - 2012-11-14 05:58 - 00000000 ____D C:\Windows\Panther
2013-11-05 22:26 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache

Some content of TEMP:
====================
C:\Users\Miro3\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-11-14 05:59

==================== End Of Log ============================







~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 8 x64
Ran by Miro3 on 06.11.2013 at 9:59:02,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.11.2013 at 10:12:08,86
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:43 on 06/11/2013 (Miro3)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-








GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-06 18:43:52
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000039 ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Miro3\AppData\Local\Temp\uwdcypob.sys


---- Kernel code sections - GMER 2.1 ----

.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960000eb400 7 bytes [C0, AD, 1C, 01, 00, EC, 9B]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960000eb408 7 bytes [01, 9D, E4, FF, 00, F0, E8]

---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\WLANExt.exe[1136] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Windows\system32\WLANExt.exe[1136] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Windows\system32\WLANExt.exe[1136] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\WLANExt.exe[1136] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\WLANExt.exe[1136] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[1200] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[1200] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[1200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[1200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[1200] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fb713e1b32 4 bytes [3E, 71, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[2356] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fb713e1b3a 4 bytes [3E, 71, FB, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2480] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2480] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2480] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2480] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2480] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2692] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2692] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2692] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2692] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2692] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[4448] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[4448] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[4448] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\nvvsvc.exe[7356] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\nvvsvc.exe[7356] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\nvvsvc.exe[7356] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Windows\system32\nvvsvc.exe[7356] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Windows\system32\nvvsvc.exe[7356] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[732] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[732] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[732] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Windows\System32\igfxpers.exe[7704] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fb7d53177a 4 bytes [53, 7D, FB, 07]
.text C:\Windows\System32\igfxpers.exe[7704] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fb7d531782 4 bytes [53, 7D, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[7520] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[7520] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[7520] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3748] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fb77351532 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3748] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fb7735153a 4 bytes [35, 77, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3748] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fb7735165a 4 bytes [35, 77, FB, 07]

---- Threads - GMER 2.1 ----

Thread C:\Windows\system32\csrss.exe [7572:1548] fffff960008185e8

---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code

---- EOF - GMER 2.1 ----