Windows 7 : Avg melded Tojaner: dropper.generik8.CLXE und kann ihn nicht entfernen

mariomon11

Seit ein paar Tagen gibt mir Avg meldung, sobald ich irgendetwas starte oder ausführe, über einen Tojaner: dropper.generik8.CLXE , wenn das Programm versucht diesen zu entfernen, schlägt es entweder fehl oder (selten) es wird "entfernt" ,kommt aber nach 5 minuten wieder. Ich würde den Trojaner den gerne loswerden.

Defogger Log:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:05 on 11/11/2013 (Kiwi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Log:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by Kiwi (administrator) on GAMER-PC on 11-11-2013 20:07:30
Running from C:\Users\Kiwi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Lenovo (Beijing) Limited) C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Nexon Korea Corp.) C:\Nexon\NexonPlug\NexonPlug.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\Bluetooth Headset Helper.exe
() C:\Program Files (x86)\Trust Gaming Mouse\Mouse.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(McAfee, Inc.) c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
() C:\Users\Kiwi\Desktop\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-22] (Synaptics Incorporated)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-05-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [6199128 2012-05-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-05-21] (Lenovo)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-01-01] ()
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1476104 2012-12-20] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2012-12-18] (Samsung Electronics)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844296 2012-12-20] (Samsung)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify] - C:\Users\Kiwi\AppData\Roaming\Spotify\spotify.exe [4643328 2013-06-23] (Spotify Ltd)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Kiwi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-06-23] (Spotify Ltd)
HKCU\...\Run: [NexonPlug] - C:\Nexon\NexonPlug\NexonPlug.exe [2120024 2013-10-16] (Nexon Korea Corp.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-05-21] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Trust Gaming Mouse] - C:\Program Files (x86)\Trust Gaming Mouse\Mouse.exe [2245632 2011-01-17] ()
HKLM-x32\...\Run: [TQ566808] - "F:\Setup.exe"
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310280 2012-12-20] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4908592 2013-10-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2404376 2013-10-02] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2345296 2013-10-01] (LogMeIn Inc.)
HKU\Default\...\RunOnce: [Lenovo.ShowBand] - C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe [52584 2013-08-08] (Lenovo)
HKU\Default User\...\RunOnce: [Lenovo.ShowBand] - C:\SWTOOLS\SimpleTap DeskBand\ShowBand.exe /show
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll c:\windows\system32\nvinitx.dll [1952224 2013-10-22] ()
AppInit_DLLs-x32: c:\progra~3\bitguard\271769~1.27\{c16c1~1\bitguard.dll [2735584 2013-10-22] ()
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=1855C01885D2AB98&affID=121845&tt=180613_ndtc&tsp=4919
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=1855C01885D2AB98&affID=121845&tt=180613_ndtc&tsp=4919
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=1855C01885D2AB98&affID=121845&tt=180613_ndtc&tsp=4919
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.0.12\ViProtocol.dll (AVG Secure Search)

Chrome:
=======
CHR HomePage: hxxp://isearch.avg.com?cid={010A57FD-D70D-43C0-A11D-52D7B495A5D6}&mid=8ff00883eaf247d384991151c336426b-b49c419320561ec3b366d6005ff47f2eedf4150b&lang=en&ds=AVG&coid=avgtbavg&pr=pr&d=2013-09-25 18:01:43&v=17.0.1.12&pid=avg&sg=0&sap=hp
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll (AVG Technologies)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (SiteAdvisor) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_1
CHR Extension: (Google Docs) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (FrankerFaceZ) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fadndhdgpmmaapbmfcknlfgcflmmmieb\1.40_0
CHR Extension: (SiteAdvisor) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_1
CHR Extension: (Auto Replay for YouTube) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanbnempkjnhadplbfgdaagijdbdbjeb\1.9.28_0
CHR Extension: (Auto HD For YouTube\u2122) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\koiaokdomkpjdgniimnkhgbilbjgpeak\5.24_0
CHR Extension: (Pokemon Red) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\njkgicmllgmdcfmfpjmkaoepfikefmlh\1_0
CHR Extension: (Google Wallet) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Kiwi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Kiwi\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.0.0.12\avg.crx

==================== Services (Whitelisted) =================

R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1358944 2013-09-25] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3538480 2013-10-03] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [301152 2013-09-25] (AVG Technologies CZ, s.r.o.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-02-13] (Lenovo (Beijing) Limited)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [30184 2013-08-08] ()
R2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe [101048 2011-02-16] (McAfee, Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [5127200 2013-05-26] (INCA Internet Co., Ltd.)
R2 vToolbarUpdater17.0.12; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe [1734680 2013-10-02] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

S3 ActionReplayDS; C:\Windows\System32\Drivers\ActionReplayDS_x64.sys [51600 2007-02-08] (Thesycon GmbH, Germany)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-03-21] (AVAST Software)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [147768 2013-09-25] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-11-03] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-05-04] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-05-04] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-05-04] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-05-04] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-05-04] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-05-04] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [239416 2013-05-04] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-10-02] (AVG Technologies)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R1 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
R1 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\FRST
2013-11-11 20:05 - 2013-11-11 20:05 - 00000470 _____ C:\Users\Kiwi\Desktop\defogger_disable.log
2013-11-11 20:05 - 2013-11-11 20:05 - 00000000 _____ C:\Users\Kiwi\defogger_reenable
2013-11-11 20:04 - 2013-11-11 20:03 - 01957590 _____ (Farbar) C:\Users\Kiwi\Desktop\FRST64.exe
2013-11-11 20:04 - 2013-11-11 20:03 - 00377856 _____ C:\Users\Kiwi\Desktop\gmer_2.1.19163.exe
2013-11-11 20:04 - 2013-11-11 20:03 - 00050477 _____ C:\Users\Kiwi\Desktop\Defogger.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 01957590 _____ (Farbar) C:\Users\Kiwi\Downloads\FRST64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 00377856 _____ C:\Users\Kiwi\Downloads\gmer_2.1.19163.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 00050477 _____ C:\Users\Kiwi\Downloads\Defogger.exe
2013-11-11 19:48 - 2013-11-11 19:48 - 00000000 ____D C:\AdwCleaner
2013-11-11 19:47 - 2013-11-11 19:47 - 01085542 _____ C:\Users\Kiwi\Downloads\adwcleaner.exe
2013-11-11 19:33 - 2013-11-12 04:38 - 00000000 _____ C:\Recovery.txt
2013-11-11 19:04 - 2013-11-11 19:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 18:37 - 2013-11-11 19:23 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-11 18:37 - 2013-11-11 19:23 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-11 18:37 - 2013-11-11 18:57 - 00000000 ____D C:\$WINDOWS.~BT
2013-11-04 19:24 - 2013-11-04 19:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2013-11-04 19:24 - 2013-11-04 19:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2013-11-04 17:39 - 2013-11-04 19:19 - 00000000 ____D C:\ProgramData\MFAData
2013-11-04 17:39 - 2013-11-04 19:19 - 00000000 ____D C:\ProgramData\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Avg2014
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Avg2014
2013-11-04 17:38 - 2013-11-04 17:38 - 04424240 _____ (AVG Technologies) C:\Users\Kiwi\Downloads\avg_avct_stb_all_2014_4116_cm10.exe
2013-11-03 18:26 - 2013-11-03 18:26 - 00057144 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgfwd6a.sys
2013-11-03 18:22 - 2013-11-03 18:22 - 04436536 _____ (AVG Technologies) C:\Users\Kiwi\Downloads\avg_isct_stb_all_2014_4158.exe
2013-11-03 17:53 - 2013-11-03 17:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2013-11-03 17:53 - 2013-11-03 17:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2013-11-03 03:00 - 2013-11-03 03:00 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-03 03:00 - 2013-11-03 03:00 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-02 21:40 - 2013-11-03 14:09 - 00000165 _____ C:\Users\Kiwi\Desktop\tembild.txt
2013-10-29 21:18 - 2013-10-29 21:18 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-10-24 19:18 - 2013-10-31 01:04 - 00001981 _____ C:\Users\Kiwi\Desktop\cooki.txt
2013-10-23 17:49 - 2013-10-23 17:49 - 00837410 _____ C:\Users\Kiwi\Downloads\117826 Duca - Welcome Berry's (1).osz
2013-10-22 02:11 - 2013-10-22 02:16 - 258366720 _____ (NVIDIA Corporation) C:\Users\Kiwi\Downloads\331.58-notebook-win8-win7-64bit-international-whql.exe
2013-10-21 20:47 - 2013-10-21 20:47 - 00001290 _____ C:\Users\Kiwi\Desktop\MineLaunchSP - Verknüpfung.lnk
2013-10-21 20:45 - 2013-10-21 20:45 - 00000000 ____D C:\Users\Kiwi\Desktop\minecraft
2013-10-21 18:39 - 2013-10-21 18:39 - 00000000 ____D C:\Users\Kiwi\Downloads\mc152-mods (1)
2013-10-21 18:20 - 2013-10-21 18:38 - 544515098 _____ C:\Users\Kiwi\Downloads\mc152-mods (1).zip
2013-10-21 18:08 - 2013-10-21 18:14 - 172932726 _____ C:\Users\Kiwi\Downloads\mc152-mods.zip
2013-10-18 19:32 - 2013-10-18 19:32 - 911787894 _____ C:\Windows\MEMORY.DMP
2013-10-18 19:32 - 2013-10-18 19:32 - 00286584 _____ C:\Windows\Minidump\101813-49405-01.dmp
2013-10-18 19:30 - 2013-10-18 19:30 - 02795931 _____ C:\Users\Kiwi\Downloads\27862 Suzaku - VANESSA.osz
2013-10-18 12:09 - 2013-10-18 12:09 - 00002832 _____ C:\Users\Kiwi\Documents\norm.rms
2013-10-18 00:42 - 2013-10-18 00:42 - 00005808 _____ C:\Users\Kiwi\Documents\olk.rms
2013-10-17 21:43 - 2013-10-17 21:43 - 00910736 _____ (ghost-mouse.com ) C:\Users\Kiwi\Downloads\GhostMouse321-Setup.exe
2013-10-17 21:43 - 2013-10-17 21:43 - 00001080 _____ C:\Users\Public\Desktop\GhostMouse Free.lnk
2013-10-17 21:43 - 2013-10-17 21:43 - 00000000 ____D C:\Users\Kiwi\Documents\AutomaticSolution Software
2013-10-17 21:43 - 2013-10-17 21:43 - 00000000 ____D C:\Program Files (x86)\GhostMouse
2013-10-17 14:36 - 2013-10-17 14:38 - 00001352 _____ C:\Users\Kiwi\Desktop\Poke.txt

==================== One Month Modified Files and Folders =======

2013-11-12 04:38 - 2013-11-11 19:33 - 00000000 _____ C:\Recovery.txt
2013-11-11 20:09 - 2013-01-01 03:03 - 00000000 ____D C:\Users\Kiwi\AppData\Local\PMB Files
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\FRST
2013-11-11 20:05 - 2013-11-11 20:05 - 00000470 _____ C:\Users\Kiwi\Desktop\defogger_disable.log
2013-11-11 20:05 - 2013-11-11 20:05 - 00000000 _____ C:\Users\Kiwi\defogger_reenable
2013-11-11 20:03 - 2013-11-11 20:04 - 01957590 _____ (Farbar) C:\Users\Kiwi\Desktop\FRST64.exe
2013-11-11 20:03 - 2013-11-11 20:04 - 00377856 _____ C:\Users\Kiwi\Desktop\gmer_2.1.19163.exe
2013-11-11 20:03 - 2013-11-11 20:04 - 00050477 _____ C:\Users\Kiwi\Desktop\Defogger.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 01957590 _____ (Farbar) C:\Users\Kiwi\Downloads\FRST64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 00377856 _____ C:\Users\Kiwi\Downloads\gmer_2.1.19163.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 00050477 _____ C:\Users\Kiwi\Downloads\Defogger.exe
2013-11-11 19:49 - 2013-04-13 17:06 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Spotify
2013-11-11 19:48 - 2013-11-11 19:48 - 00000000 ____D C:\AdwCleaner
2013-11-11 19:47 - 2013-11-11 19:47 - 01085542 _____ C:\Users\Kiwi\Downloads\adwcleaner.exe
2013-11-11 19:46 - 2013-05-24 15:33 - 00000000 ____D C:\Users\Kiwi\AppData\Local\LogMeIn Hamachi
2013-11-11 19:46 - 2012-05-21 19:01 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-11 19:43 - 2012-12-31 12:48 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Skype
2013-11-11 19:42 - 2013-01-27 17:00 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-11 19:41 - 2012-05-21 19:01 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-11 19:41 - 1601-01-02 05:16 - 00132681 _____ C:\Windows\system32\fastboot.set
2013-11-11 19:40 - 1601-01-02 05:16 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-11 19:39 - 1601-01-02 05:16 - 00000333 _____ C:\Windows\setupact.log
2013-11-11 19:33 - 2012-09-15 17:01 - 00000000 __SHD C:\Recovery
2013-11-11 19:30 - 2009-07-14 05:45 - 00316560 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-11 19:23 - 2013-11-11 18:37 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-11 19:23 - 2013-11-11 18:37 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-11 19:20 - 1601-01-02 05:16 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:04 - 2013-11-11 19:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 18:57 - 2013-11-11 18:37 - 00000000 ____D C:\$WINDOWS.~BT
2013-11-11 18:37 - 2012-05-21 18:17 - 01711152 _____ C:\Windows\WindowsUpdate.log
2013-11-04 19:24 - 2013-11-04 19:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2013-11-04 19:24 - 2013-11-04 19:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2013-11-04 19:19 - 2013-11-04 17:39 - 00000000 ____D C:\ProgramData\MFAData
2013-11-04 19:19 - 2013-11-04 17:39 - 00000000 ____D C:\ProgramData\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MFAData
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Avg2014
2013-11-04 17:39 - 2013-11-04 17:39 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Avg2014
2013-11-04 17:38 - 2013-11-04 17:38 - 04424240 _____ (AVG Technologies) C:\Users\Kiwi\Downloads\avg_avct_stb_all_2014_4116_cm10.exe
2013-11-03 18:26 - 2013-11-03 18:26 - 00057144 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgfwd6a.sys
2013-11-03 18:22 - 2013-11-03 18:22 - 04436536 _____ (AVG Technologies) C:\Users\Kiwi\Downloads\avg_isct_stb_all_2014_4158.exe
2013-11-03 18:21 - 1601-01-02 05:16 - 01643872 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-03 18:21 - 1601-01-02 05:16 - 00712326 _____ C:\Windows\system32\perfh007.dat
2013-11-03 18:21 - 1601-01-02 05:16 - 00153276 _____ C:\Windows\system32\perfc007.dat
2013-11-03 17:53 - 2013-11-03 17:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2013-11-03 17:53 - 2013-11-03 17:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2013-11-03 14:10 - 2013-06-27 10:57 - 00433400 _____ C:\Windows\PFRO.log
2013-11-03 14:09 - 2013-11-02 21:40 - 00000165 _____ C:\Users\Kiwi\Desktop\tembild.txt
2013-11-03 14:09 - 2012-12-31 12:54 - 00000000 ____D C:\Program Files (x86)\osu!
2013-11-03 14:08 - 2013-09-25 17:00 - 00000000 ____D C:\ProgramData\AVG2014
2013-11-03 03:00 - 2013-11-03 03:00 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-03 03:00 - 2013-11-03 03:00 - 00000000 ____D C:\ProgramData\BitGuard
2013-11-02 19:05 - 2013-06-02 00:13 - 00001507 _____ C:\Users\Kiwi\Desktop\Neues Textdokument.txt
2013-10-31 21:53 - 2012-09-15 17:02 - 00000000 ___RD C:\Users\Kiwi\Desktop\.
2013-10-31 01:04 - 2013-10-24 19:18 - 00001981 _____ C:\Users\Kiwi\Desktop\cooki.txt
2013-10-29 21:18 - 2013-10-29 21:18 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-10-28 22:21 - 2013-08-02 21:27 - 00000000 ____D C:\Users\Kiwi\Desktop\Neuer Ordner (2)
2013-10-28 04:28 - 2013-01-01 03:03 - 00000000 ____D C:\ProgramData\PMB Files
2013-10-23 17:49 - 2013-10-23 17:49 - 00837410 _____ C:\Users\Kiwi\Downloads\117826 Duca - Welcome Berry's (1).osz
2013-10-22 02:16 - 2013-10-22 02:11 - 258366720 _____ (NVIDIA Corporation) C:\Users\Kiwi\Downloads\331.58-notebook-win8-win7-64bit-international-whql.exe
2013-10-22 02:03 - 2013-07-13 10:41 - 00039139 _____ C:\Windows\IE10_main.log
2013-10-22 02:03 - 2013-07-13 10:41 - 00039139 _____ C:\Windows\IE10_main.log
2013-10-21 20:47 - 2013-10-21 20:47 - 00001290 _____ C:\Users\Kiwi\Desktop\MineLaunchSP - Verknüpfung.lnk
2013-10-21 20:45 - 2013-10-21 20:45 - 00000000 ____D C:\Users\Kiwi\Desktop\minecraft
2013-10-21 19:43 - 1601-01-02 05:16 - 548703693 _____ C:\Users\Kiwi\Desktop\minecraft.rar
2013-10-21 18:39 - 2013-10-21 18:39 - 00000000 ____D C:\Users\Kiwi\Downloads\mc152-mods (1)
2013-10-21 18:38 - 2013-10-21 18:20 - 544515098 _____ C:\Users\Kiwi\Downloads\mc152-mods (1).zip
2013-10-21 18:14 - 2013-10-21 18:08 - 172932726 _____ C:\Users\Kiwi\Downloads\mc152-mods.zip
2013-10-21 17:59 - 2013-07-18 20:59 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\.minecraft
2013-10-18 19:32 - 2013-10-18 19:32 - 911787894 _____ C:\Windows\MEMORY.DMP
2013-10-18 19:32 - 2013-10-18 19:32 - 00286584 _____ C:\Windows\Minidump\101813-49405-01.dmp
2013-10-18 19:32 - 2013-05-14 20:17 - 00000000 ____D C:\Windows\Minidump
2013-10-18 19:30 - 2013-10-18 19:30 - 02795931 _____ C:\Users\Kiwi\Downloads\27862 Suzaku - VANESSA.osz
2013-10-18 12:09 - 2013-10-18 12:09 - 00002832 _____ C:\Users\Kiwi\Documents\norm.rms
2013-10-18 00:42 - 2013-10-18 00:42 - 00005808 _____ C:\Users\Kiwi\Documents\olk.rms
2013-10-17 21:43 - 2013-10-17 21:43 - 00910736 _____ (ghost-mouse.com ) C:\Users\Kiwi\Downloads\GhostMouse321-Setup.exe
2013-10-17 21:43 - 2013-10-17 21:43 - 00001080 _____ C:\Users\Public\Desktop\GhostMouse Free.lnk
2013-10-17 21:43 - 2013-10-17 21:43 - 00000000 ____D C:\Users\Kiwi\Documents\AutomaticSolution Software
2013-10-17 21:43 - 2013-10-17 21:43 - 00000000 ____D C:\Program Files (x86)\GhostMouse
2013-10-17 14:38 - 2013-10-17 14:36 - 00001352 _____ C:\Users\Kiwi\Desktop\Poke.txt
2013-10-16 19:49 - 2012-12-31 13:05 - 00000000 ____D C:\Users\Kiwi\Desktop\Bilder Undso
2013-10-12 03:28 - 2013-05-04 20:21 - 00000000 ____D C:\Program Files (x86)\AVG

Some content of TEMP:
====================
C:\Users\Kiwi\AppData\Local\Temp\i4jdel0.exe
C:\Users\Kiwi\AppData\Local\Temp\oi_{CCE161DE-F8A6-4D6E-96A2-A257E783E790}.exe
C:\Users\Kiwi\AppData\Local\Temp\oi_{D77099F0-FEC0-4A12-B952-461E7CAAEA8A}.exe
C:\Users\Kiwi\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-26 17:39

==================== End Of Log ============================

Addition :
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01
Ran by Kiwi at 2013-11-11 20:09:25
Running from C:\Users\Kiwi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG Internet Security 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2014 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Action Replay Code Manager (x32)
Adobe AIR (x32 Version: 3.8.0.870)
Adobe Flash Player 10 Plugin (x32 Version: 10.3.181.14)
Adobe Reader X (10.1.1) - Deutsch (x32 Version: 10.1.1)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.8.638)
Apple Application Support (x32 Version: 2.3.4)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.9.9)
Audacity 2.0.3 (x32 Version: 2.0.3)
AVG 2014 (Version: 14.0.3629)
AVG 2014 (Version: 14.0.4158)
AVG 2014 (Version: 2014.0.4158)
AVG Security Toolbar (x32 Version: 17.0.1.12)
Bandicam (x32 Version: 1.8.9.371)
Bandisoft MPEG-1 Decoder (x32)
Benutzerhandbuch (x32 Version: 1.0.0.6)
BitGuard (x32)
CABAL Online Europe (Europe) (x32)
CamStudio version 2.7 (x32 Version: 2.7)
CCleaner (Version: 4.02)
Conexant HD Audio (Version: 8.54.32.50)
Counter-Strike 1.6 (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
Daum PotPlayer 1.5.37776 (x32)
Delta Chrome Toolbar (x32)
Delta toolbar (x32 Version: 1.8.21.5)
Dolby Advanced Audio v2 (x32 Version: 7.2.7000.11)
Dota 2 (x32)
Dota 2 Test (x32)
Dragon's Prophet (x32 Version: 1.2.1161.12)
Elsword_DE (x32)
Energy Management (x32 Version: 7.0.3.4)
FFsplit version 0.7 (x32 Version: 0.7)
GhostMouse (x32 Version: Free V3.2.1)
GIMP 2.8.2 (Version: 2.8.2)
Google Chrome (x32 Version: 30.0.1599.101)
Google Update Helper (x32 Version: 1.3.21.165)
HandBrake 0.9.9.1 (x32 Version: 0.9.9.1)
Heroes of Newerth (x32 Version: 2.3.0)
Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 8.0.3.1427)
Intel(R) OpenCL CPU Runtime (x32)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2656)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)
Intel® Trusted Connect Service Client (Version: 1.23.605.1)
Java 7 Update 10 (x32 Version: 7.0.100)
Java 7 Update 17 (64-bit) (Version: 7.0.170)
Java Auto Updater (x32 Version: 2.1.9.0)
Java SE Development Kit 7 Update 17 (64-bit) (Version: 1.7.0.170)
Java(TM) 6 Update 20 (x32 Version: 6.0.200)
JDownloader 0.9 (x32 Version: 0.9)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
League of Legends (x32 Version: 1.3)
Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.5.1.2300)
Lenovo EasyCamera (x32 Version: 13.11.1206.1)
Lenovo EE Boot Optimizer (Version: 0.0.1.9)
Lenovo OneKey Recovery (Version: 7.0.0.3712)
Lenovo OneKey Recovery (x32 Version: 7.0.0.3712)
Lenovo PowerDVD10 (x32 Version: 10.0.3712.52)
Lenovo Solution Center (Version: 2.2.002.00)
Lenovo YouCam (x32 Version: 3.1.3728)
Lenovo_Wireless_Driver (x32 Version: 1.02.01)
LockKey (x32 Version: 1.38.1.2)
LogMeIn Hamachi (x32 Version: 2.2.0.58)
McAfee SiteAdvisor (Version: 3.3.1.133)
McAfee SiteAdvisor (x32 Version: 3.6.196)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5139.5005)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0)
MyFreeCodec (HKCU)
Nexon Game Manager (x32)
NVIDIA Grafiktreiber 295.93 (Version: 295.93)
NVIDIA Install Application (Version: 2.1002.62.312)
NVIDIA Optimus 1.7.12 (Version: 1.7.12)
NVIDIA PhysX (x32 Version: 9.11.1111)
NVIDIA PhysX-Systemsoftware 9.11.1111 (Version: 9.11.1111)
NVIDIA Systemsteuerung 295.93 (Version: 295.93)
NVIDIA Update 1.7.12 (Version: 1.7.12)
NVIDIA Update Components (Version: 1.7.12)
OpenOffice.org 3.2 (x32 Version: 3.2.9502)
osu! (x32 Version: 0.0.0.0)
Pando Media Booster (x32 Version: 2.6.0.8)
Pokemon Online 2.0.07 (x32)
Power2Go (x32 Version: 5.6.0.7303)
QuickTime (x32 Version: 7.74.80.86)
Rainmeter (x32 Version: 2.5 r1842)
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7601.39016)
Samsung Kies (x32 Version: 2.5.1.12123_2)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.16.0)
Skype™ 6.6 (x32 Version: 6.6.106)
Smite (x32 Version: 0.1.1581.4)
Sora no Otoshimono V5 (x32)
Spotify (HKCU Version: 0.9.1.53.g876fa9df)
Steam (x32 Version: 1.0.0.0)
Synaptics Pointing Device Driver (Version: 15.3.39.0)
TeamSpeak 3 Client (x32 Version: 3.0.10)
TeamViewer 8 (x32 Version: 8.0.16642)
TERA (x32 Version: 19.04.02.03.hf3)
Trust Gaming Mouse Driver V1.1 (x32)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
UserGuide (x32 Version: 1.0.0.6)
Vegas Pro 12.0 (64-bit) (Version: 12.0.563)
VeriFace (x32 Version: 4.0.1.1230)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1)
VLC media player 2.0.6 (x32 Version: 2.0.6)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (Version: 12/15/2011 7.1.0.1)
YGOPro DevPro version 1.9.2r2 (x32 Version: 1.9.2r2)
넥슨플러그 (x32)
엘소드 (x32)

==================== Restore Points =========================


==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {58828C7B-810A-488A-90DB-AA2DE75AE5CD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {7D914431-5E0B-4FDD-984D-094F84959F90} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => C:\Windows\System32\pla.dll [2010-11-21] (Microsoft Corporation)
Task: {A17C84CA-4876-4240-93E9-A55EEEC1F9E9} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
Task: {A4352AA1-A1C1-43C9-BDF0-652A676F96A5} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-08-08] (Lenovo)
Task: {B8B37C87-07F2-4D59-ABA5-02568293D5F2} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-08-08] (Lenovo)
Task: {BC0F1E86-1B67-4A51-9B4F-81048E7D35AF} - System32\Tasks\CreateHardwareScanTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-08-08] (Lenovo)
Task: {BD28C432-39C8-408C-85CE-FE51F7B3AE84} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-21] (Google Inc.)
Task: {C86C7CB7-8EB7-47B6-9DBD-0E774D575E94} - System32\Tasks\EPUpdater => C:\Users\Kiwi\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] ()
Task: {E47322B0-AC91-4285-BF33-7CDC19D3936B} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {E83017A2-2869-48B3-B42D-2B9E8CA961F7} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-08-08] ()
Task: {EBC2DD44-2880-4BB7-96D1-2D7411BABD26} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-21] (Google Inc.)
Task: {FC2D065B-91A8-480E-A31E-7878089A0CF1} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-08-08] ()
Task: {FD6CAA58-A8FC-4928-B7BD-0872996220C1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-10-29 21:18 - 2013-10-22 16:11 - 01952224 _____ () C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\loader.dll
2012-05-21 18:58 - 2012-05-21 18:58 - 01508192 _____ () C:\Windows\system32\IcnOvrly.dll
2012-05-21 18:58 - 2012-05-21 18:58 - 00628064 _____ () C:\Windows\system32\SimpleExt.dll
2012-03-05 09:28 - 2012-02-17 17:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2008-12-20 02:20 - 2012-05-21 19:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 15:30 - 2012-05-21 19:02 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 15:31 - 2012-05-21 19:02 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 02:20 - 2012-05-21 19:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2013-06-19 21:14 - 2013-03-24 15:40 - 00731832 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2013-10-29 21:18 - 2013-10-22 16:09 - 02735584 _____ () C:\ProgramData\BitGuard\2.7.1769.27\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll
2013-08-02 21:17 - 2006-12-12 03:27 - 00387072 _____ () C:\Nexon\NexonPlug\mss32.dll
2013-08-02 21:17 - 2006-12-12 03:27 - 00150528 _____ () C:\Nexon\NexonPlug\mssmp3.asi
2013-01-11 13:32 - 2010-05-04 15:36 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-10-02 11:19 - 2013-10-02 11:18 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\log4cplusU.dll
2012-05-21 18:58 - 2012-05-21 18:58 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2013-10-02 11:19 - 2013-10-02 11:18 - 00142360 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.0.12\SiteSafety.dll
2013-10-18 19:39 - 2013-10-09 01:01 - 00698832 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
2013-10-18 19:39 - 2013-10-09 01:01 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\libegl.dll
2013-10-18 19:39 - 2013-10-09 01:02 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll
2013-10-18 19:39 - 2013-10-09 01:02 - 00415184 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
2013-10-18 19:39 - 2013-10-09 01:01 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll
2013-08-15 07:02 - 2013-08-15 07:02 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\12ed7e59e6a11d2c112a06a4091faa4a\IsdiInterop.ni.dll
2012-05-21 18:22 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-05-21 18:23 - 2012-02-21 05:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/11/2013 07:56:48 PM) (Source: Application Hang) (User: )
Description: Programm adwcleaner.exe, Version 3.0.1.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1d94

Startzeit: 01cedf0e9247df42

Endzeit: 3

Anwendungspfad: C:\Users\Kiwi\Downloads\adwcleaner.exe

Berichts-ID:

Error: (11/11/2013 07:44:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 07:18:20 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 07:13:48 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (11/11/2013 07:03:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 06:25:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/04/2013 07:01:40 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (11/04/2013 06:50:41 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/04/2013 05:45:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/03/2013 06:33:23 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/11/2013 07:42:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/11/2013 07:42:55 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LogMeIn Hamachi Tunneling Engine erreicht.

Error: (11/11/2013 07:41:13 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Hi-Rez Studios Authenticate and Update Service erreicht.

Error: (11/11/2013 07:39:39 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎11.‎11.‎2013 um 19:24:41 unerwartet heruntergefahren.

Error: (11/11/2013 07:16:53 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Hi-Rez Studios Authenticate and Update Service erreicht.

Error: (11/11/2013 07:12:56 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (11/11/2013 06:58:41 PM) (Source: DCOM) (User: )
Description: {AD3EDBCA-0901-415B-82E9-C16D3B65E38C}

Error: (11/11/2013 06:34:01 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 10 für Windows 7 für x64-basierte Systeme

Error: (11/11/2013 06:34:01 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80073712 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer 9 für Windows 7 für x64-Systeme (KB2879017)

Error: (11/11/2013 06:24:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================
Error: (11/11/2013 07:56:48 PM) (Source: Application Hang)(User: )
Description: adwcleaner.exe3.0.1.21d9401cedf0e9247df423C:\Users\Kiwi\Downloads\adwcleaner.exe

Error: (11/11/2013 07:44:35 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 07:18:20 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 07:13:48 PM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (11/11/2013 07:03:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/11/2013 06:25:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/04/2013 07:01:40 PM) (Source: CVHSVC)(User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (11/04/2013 06:50:41 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/04/2013 05:45:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/03/2013 06:33:23 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 35%
Total physical RAM: 8094.36 MB
Available physical RAM: 5205 MB
Total Pagefile: 16186.9 MB
Available Pagefile: 12896.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:886.32 GB) (Free:490.02 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:25.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: CF2DB9F7)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=886 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=20 GB) - (Type=12)

==================== End Of Log ============================


Gmer Log :
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-11 20:25:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR1 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Kiwi\AppData\Local\Temp\pgdoqpow.sys


---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2000] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\AVG\AVG2014\avgfws.exe[1904] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\AVG\AVG2014\avgfws.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\AVG\AVG2014\avgfws.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1544] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[1544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[2916] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe[2936] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2944] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 000000007703000c 1 byte [C3]
.text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2944] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 00000000770bf85a 5 bytes JMP 000000017706d571
.text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2944] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Users\Kiwi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[844] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Users\Kiwi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Users\Kiwi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2740] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3168] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3184] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[3456] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[3456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[3456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[3464] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[3464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[3464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[3892] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[3892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe[3892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe[3676] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2584] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe[4132] C:\Windows\syswow64\user32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[4448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Windows\SysWOW64\RunDll32.exe[4448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Users\Kiwi\Desktop\Defogger.exe[6728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Users\Kiwi\Desktop\Defogger.exe[6728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2
.text C:\Users\Kiwi\Desktop\gmer_2.1.19163.exe[7828] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 00000000761bcfca 5 bytes JMP 0000000171905820
.text C:\Users\Kiwi\Desktop\gmer_2.1.19163.exe[7828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d61465 2 bytes [D6, 75]
.text C:\Users\Kiwi\Desktop\gmer_2.1.19163.exe[7828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d614bb 2 bytes [D6, 75]
.text ... * 2

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885d2ab98
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885d2ab98@d831cf92b794 0xC0 0x23 0x53 0xBA ...
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8A43C46F-A957-4CB4-83F1-B75B2A0DC808}@LeaseObtainedTime 1384197376
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8A43C46F-A957-4CB4-83F1-B75B2A0DC808}@T1 1384197503
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8A43C46F-A957-4CB4-83F1-B75B2A0DC808}@T2 1384197599
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8A43C46F-A957-4CB4-83F1-B75B2A0DC808}@LeaseTerminatesTime 1384197631
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885d2ab98 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885d2ab98@d831cf92b794 0xC0 0x23 0x53 0xBA ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer@CleanShutdown 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers@DisableAutoplay 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon@ C:\Windows\System32\imageres.dll,-109
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\DefaultIcon@ C:\Windows\System32\imageres.dll,-123
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon@full C:\Windows\System32\imageres.dll,-54
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon@ C:\Windows\System32\imageres.dll,-55
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon@empty C:\Windows\System32\imageres.dll,-55
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon@ C:\Windows\System32\imageres.dll,-25
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew@Classes .bmp?.contact?.jnt?.library-ms?.lnk?.rtf?.txt?.zip?Briefcase?Folder?
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList@MRUList a
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2@FavoritesRemovedChanges 8
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband@FavoritesChanges 7
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband@FavoritesRemovedChanges 8
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images@ID-1 AYAFA8BUg/E0gouOpBhoYjAArADMdmBAvMkOcBAAAAAAAAAAAAAAAAAAAAAAAAgUAEDAAAAAA8SQaCIMAcVauR2b3NHA8AACAQAAv7r76UoGvEkmAqCAAAwlCAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQaA4GAkBwb AcHAzBAAAYBAGBQMAAAAAAQtAtvTwAwVlJGA0AACAQAAv7r76goGurDFsoCAAAApQAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQZAIGAAAgEAgFAxAAAAAAA2CEgZADAXFETMBVQ+FDAAAEAIAABA8uvur DFsYLQAmhKAAAAlCBAAAAABAAAAAAAAAAAAAAAAAAAAcFAhBAbAwGAwBQYAAHAlBgcAAAAYAQ4EEDAAAAAAYLQAmBMAwUZu9mdv9VMAAgPAgAAEAw7+aLQAmhtABYGqAAAAM8JBAAAAYAAAAAAAAAA AAAAAAAAAAATAUGAuBwbAYHAvBwXAEDAAAAGAsIBAAAEA8uvBAAAAkHBAAQdEAAAxMFUTVQ1NXNnusBETeJCAsCL57aIAAAAQAAAAAwSAUGA5BgOAAFAJBARAAAATAAAAQGAAAQeDAAAUAAAAAwQA8 GAuBAZAkGA0BQaA8GAuBAAAIEAAAgHAAAAwBgcA8GAwBANAIDA5AANAkDA2AwNAIDA5AQNAAAAAAwLDAAAT04bR4BEl+EhU/vg5hTG1AAAAAQAAAAALAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAgBAAAAqAgLAoGAwBwZAAAAAAQAAAAAAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQ advBI17hZdc2k4YukBAAAsAAAAwHAcAAAAgKA4CAqBAcAUGAnBAAAAAABAAAAAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAgBAAAAqAgLAIGAtBAcAAAAAA QAAAAAAAAAJyV8Sdh
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\Images@ID-2 AYAFA8BUg/E0gouOpBhoYjAArADMdmBAvMkOcBAAAAAAAAAAAAAAAAAAAAAAAAgUAEDAAAAAA8SQaCIMAcVauR2b3NHA8AACAQAAv7r76UoGvEkmAqCAAAwlCAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQaA4GAkBwb AcHAzBAAAYBAGBQMAAAAAAQtAtvTwAwVlJGA0AACAQAAv7r76goGurDFsoCAAAApQAAAAAQAAAAAAAAAAAAAAAAAAAAAXBQZAIGAAAgEAgFAxAAAAAAA2CEgZADAXFETMBVQ+FDAAAEAIAABA8uvur DFsYLQAmhKAAAAlCBAAAAABAAAAAAAAAAAAAAAAAAAAcFAhBAbAwGAwBQYAAHAlBgcAAAAYAQ4EEDAAAAAAYLQAmBMAwUZu9mdv9VMAAgPAgAAEAw7+aLQAmhtABYGqAAAAM8JBAAAAYAAAAAAAAAA AAAAAAAAAAATAUGAuBwbAYHAvBwXAEDAAAAGAsIBAAAEA8uvBAAAAkHBAAQdEAAAxMFUTVQ1NXNnusBETeJCAsCL57aIAAAAQAAAAAwSAUGA5BgOAAFAJBARAAAATAAAAQGAAAQeDAAAUAAAAAwQA8 GAuBAZAkGA0BQaA8GAuBAAAIEAAAgHAAAAwBgcA8GAwBANAIDA5AANAkDA2AwNAIDA5AQNAAAAAAwLDAAAT04bR4BEl+EhU/vg5hTG1AAAAAQAAAAALAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAgBAAAAqAgLAoGAwBwZAAAAAAQAAAAAAAAAJyV8SdhWhj0uNb0o4zJfCDAAAAA4a9cQ advBI17hZdc2k4YukBAAAsAAAAwHAcAAAAgKA4CAqBAcAUGAnBAAAAAABAAAAAAAAkIXxL1FaFOS72sRjiPn8JMAAAAAgr1zBp19GgUvHm1xZTij5SGAAAwCAAAAfAgBAAAAqAgLAIGAtBAcAAAAAA QAAAAAAAAAJyV8Sdh
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110320131104
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104@CachePrefix :2013110320131104:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104@CacheLimit 8192
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110320131104@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad@WpadLastNetwork {35186997-275D-44A7-A629-96F0FA29E695}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\bc-05-43-f5-11-9f
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\bc-05-43-f5-11-9f@WpadDecisionReason 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\bc-05-43-f5-11-9f@WpadDecisionTime 0xF0 0x2F 0xA4 0x84 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\bc-05-43-f5-11-9f@WpadDecision 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}@WpadDecisionReason 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}@WpadDecisionTime 0xF0 0x2F 0xA4 0x84 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}@WpadDecision 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}@WpadNetworkName FRITZ!Box Fon WLAN 7112
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35186997-275D-44A7-A629-96F0FA29E695}\bc-05-43-f5-11-9f
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager@DllName %SystemRoot%\resources\Themes\Aero\Aero.msstyles
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Themes@CurrentTheme C:\Users\Kiwi\AppData\Local\Microsoft\Windows\Themes\oem.theme
Reg HKCU\Software\Microsoft\Windows\DWM@CompositionPolicy 0
Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationColor 1802811644
Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationColorBalance 8
Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationAfterglow 1802811644
Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationAfterglowBalance 43
Reg HKCU\Software\Microsoft\Windows\DWM@ColorizationBlurBalance 49
Reg HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop@IconSize 18
Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting@LastQueuePesterTime 0xB0 0x20 0x13 0x4E ...
Reg HKCU\Software\Microsoft\Windows Live\QoS@UUID 6B1BC6E1-A69F-4197-96E9-F86B6477F37E

---- Files - GMER 2.1 ----

File C:\Windows\asd.log 49 bytes
File C:\Windows\de-de.log 9187983 bytes
File C:\Windows\SAII_LOG.TXT 703034 bytes
File C:\Windows\Synaptics.log 1366 bytes
File C:\Windows\TSSysprep.log 5949 bytes
File C:\Windows\DPINST.LOG 10928 bytes
File C:\Windows\DtcInstall.log 5075 bytes
File C:\Windows\system32\aspnet_counters.dll (size mismatch) 20832/30160 bytes executable
File C:\Windows\system32\NCCount.bin 0 bytes
File C:\Windows\system32\MRT.exe (size mismatch) 72013344/80541720 bytes executable
File C:\Windows\system32\msvcr100_clr0400.dll (size mismatch) 827744/17896 bytes executable
File C:\Windows\system32\UICommu.bin 228 bytes
File C:\Windows\system32\mfevtps.exe 158832 bytes executable
File C:\Windows\system32\drivers\mfeapfk.sys 156792 bytes executable
File C:\Windows\system32\drivers\mfeavfk.sys 227856 bytes executable
File C:\Windows\system32\drivers\mfeclnk.sys 9984 bytes executable
File C:\Windows\system32\drivers\mfefirek.sys 481376 bytes executable
File C:\Windows\system32\drivers\mfehidk.sys 639216 bytes executable
File C:\Windows\system32\drivers\mfenlfk.sys 75672 bytes executable
File C:\Windows\system32\drivers\mferkdet.sys 98728 bytes executable
File C:\Windows\system32\drivers\mfewfpk.sys 281928 bytes
File C:\Windows\system32\drivers\cfwids.sys 65128 bytes executable
File C:\Windows\system32\drivers\ASWFW.sys 127136 bytes
File C:\Windows\system32\drivers\ASWNDIS.sys 12368 bytes executable
File C:\Windows\system32\drivers\ASWNDIS2.sys 263096 bytes
File C:\Windows\system32\drivers\aswrdr2.sys 70992 bytes executable
File C:\Windows\system32\drivers\ASWRVRT.sys 65336 bytes executable
File C:\Windows\system32\drivers\ASWSNX.sys 984144 bytes executable
File C:\Windows\system32\drivers\ASWSP.sys 370288 bytes executable
File C:\Windows\system32\drivers\ASWTDI.sys 59728 bytes executable
File C:\Windows\system32\drivers\ASWVMM.sys 178624 bytes executable
File C:\Windows\system32\drivers\avgtpx64.sys (size mismatch) 40736/46368 bytes executable <-- ROOTKIT !!!
File C:\Users\Kiwi\IMG_3863.JPG 0 bytes
File C:\Users\Kiwi\IMG_3863.JPG.part 0 bytes
File C:\Users\Kiwi\IMG_3866.JPG 0 bytes
File C:\Users\Kiwi\IMG_3866.JPG.part 0 bytes
File C:\ProgramData\Google 0 bytes
File C:\ProgramData\BrowserDefender 0 bytes
File C:\ProgramData\OneKey Reminder 0 bytes

---- Services - GMER 2.1 ----

Service C:\Windows\system32\drivers\avgtpx64.sys [SYSTEM] avgtp <-- ROOTKIT !!!

---- EOF - GMER 2.1 ----


Danke im vorraus