Hallo,

Vorgeschichte:
Gestern als ich alle Fenster schließen wollte, fand ich ein "Werbe-"fenster. Ich hätte Zugriff auf eine illegale Seite und solle doch am besten jetzt 100 Euro (paycash?) innerhalb von 12 Stunden überweisen damit man von einer Anzeige absieht.

- Ich war mit Firefox im Internet.
- Benutze jetzt den infizierten PC. Bin auch jetzt über Firefox drinnen. Alles scheint zu funktionieren.
- Das BKA-Fenster habe ich gestern über Task-Manager geschlossen.

Ich habe schon ein bisschen darüber gelesen, allerdings gibt es unterschiedliche Ansätze und ich habe überhaupt keine Ahnung, was ich tun sollte , da

ich keine Systemwiederherstellung durchführen kann. Kein Systemwh.punkt da. Ich habe leider noch keine CD angelegt. Sicher nicht so klug. Das tut mir auch leid.

Bitte helft mir!! Ich brauche das Notebook für meine Arbeiten.
Vielen Dank.

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Die 2 Outputs, bitteschön.


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by X (administrator) on Y on 17-11-2013 17:01:56
Running from C:\Users\X\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
(Microsoft Corporation) C:\windows\system32\dashost.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
( ) C:\windows\system32\lxeccoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
() C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(Dropbox, Inc.) C:\Users\X\AppData\Roaming\Dropbox\bin\Dropbox.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223245 2012-07-27] ()
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [lxecmon.exe] - C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe [772712 2013-01-23] ()
HKLM\...\Run: [EzPrint] - C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe [150264 2013-01-23] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [Lync] - C:\Program Files\Microsoft Office\Office15\lync.exe [22111392 2013-07-10] (Microsoft Corporation)
HKCU\...\Run: [FreeAC] - C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1328976 2012-04-25] (Comfort Software Group)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_117_Plugin.exe -update plugin [829832 2013-10-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes
HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-30] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-02-19] (Geek Software GmbH)
HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Administrator\...\Run: [] - [x]
HKU\Administrator\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
Startup: C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\X\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - DefaultScope {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {23655BA9-296D-4937-9388-998AC370C18A} URL = 
SearchScopes: HKCU - {23655BA9-296D-4937-9388-998AC370C18A} URL = 
SearchScopes: HKCU - {F05D0A4E-5319-4AF1-89A4-AF08AE467486} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=790a6cd2-a90a-43f9-b4ce-049724f4e996&apn_sauid=082A90C1-DFE8-4F87-A4BB-FC5F0F8857F6
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM-x32 {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u24-windows-i586.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{F4112086-05A5-45AF-9E45-057616192A47}: [NameServer]141.78.7.250,141.78.7.200

FireFox:
========
FF ProfilePath: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\X\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\ich@maltegoetz.de
FF Extension: YouTube Unblocker - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\youtubeunblocker@unblocker.yt
FF Extension: jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi
FF Extension: youtube2mp3 - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Microsoft Office 2013) - C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2013) - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Unity Player) - C:\Users\X\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\windows\SysWOW64\npDeployJava1.dll No File
CHR Extension: (Google Docs) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Timer) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\edebbhkhcaafmolanelponjjanocpacd\1.8.0.4_0
CHR Extension: (Google Wallet) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
S2 lxecCATSCustConnectService; C:\windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
R2 lxec_device; C:\windows\system32\lxeccoms.exe [1052328 2010-04-14] ( )
R2 lxec_device; C:\windows\SysWow64\lxeccoms.exe [598696 2010-04-14] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-10] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2013-03-02] (Avira GmbH)
R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2013-03-02] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-21] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-17 17:01 - 2013-11-17 17:02 - 00019948 _____ C:\Users\X\Downloads\FRST.txt
2013-11-17 17:01 - 2013-11-17 17:01 - 00000000 ____D C:\FRST
2013-11-17 16:47 - 2013-11-17 16:47 - 01958026 _____ (Farbar) C:\Users\X\Downloads\FRST64.exe
2013-11-17 16:41 - 2013-11-17 16:41 - 104695876 _____ C:\windows\SysWOW64\ﳿⴴL…
2013-11-17 14:14 - 2013-11-17 14:15 - 00916240 _____ C:\windows\Minidump\111713-32682-01.dmp
2013-11-17 14:14 - 2013-11-17 14:14 - 00444464 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 13:35 - 2013-11-17 13:35 - 104641146 _____ C:\windows\SysWOW64\᯾瞉ℐ™߿
2013-11-17 12:50 - 2013-11-17 12:55 - 00017018 _____ C:\Users\X\Desktop\Anschreiben.odt
2013-11-16 22:39 - 2013-11-16 22:39 - 104637397 _____ C:\windows\SysWOW64\촫ꟼLĬ
2013-11-16 13:49 - 2013-11-16 13:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 01:51 - 2013-11-16 01:51 - 104513208 _____ C:\windows\SysWOW64\΅魱L¡
2013-11-15 17:51 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-15 17:51 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 04:01 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-15 04:01 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-15 04:01 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll
2013-11-15 04:01 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll
2013-11-15 01:47 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys
2013-11-15 01:47 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-15 01:47 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
2013-11-15 01:47 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-15 01:47 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-15 01:47 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-15 01:47 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-15 01:47 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-15 01:47 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-15 01:47 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2013-11-15 01:47 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2013-11-15 01:47 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2013-11-15 01:47 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2013-11-15 01:47 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-15 01:47 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys
2013-11-15 01:47 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll
2013-11-15 01:47 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll
2013-11-15 01:47 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys
2013-11-15 01:47 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys
2013-11-15 01:47 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2013-11-15 01:47 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2013-11-15 01:47 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2013-11-15 01:47 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2013-11-15 01:47 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll
2013-11-15 01:47 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-15 01:46 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-15 01:46 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-15 01:46 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-14 22:09 - 2013-11-14 22:09 - 104278918 _____ C:\windows\SysWOW64\㿔ߏLû
2013-11-14 14:47 - 2013-11-14 14:47 - 00000000 ____D C:\Users\Administrator\Desktop\RStudio
2013-11-14 14:46 - 2013-11-14 14:47 - 00000000 ____D C:\Users\X\Desktop\RStudio
2013-11-14 14:33 - 2013-11-14 14:33 - 00000000 ____D C:\Program Files\RStudio
2013-11-14 14:30 - 2013-11-14 14:31 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551(1).exe
2013-11-14 14:28 - 2013-11-14 14:28 - 00001043 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001035 _____ C:\Users\Public\Desktop\R i386 3.0.2.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001028 _____ C:\Users\Public\Desktop\R x64 3.0.2.lnk
2013-11-14 14:24 - 2013-11-14 14:24 - 00000000 ____D C:\Program Files\R
2013-11-14 14:23 - 2013-11-14 14:24 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win(1).exe
2013-11-14 14:11 - 2013-11-14 14:12 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win.exe
2013-11-14 14:06 - 2013-11-14 14:07 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551.exe
2013-11-14 10:58 - 2013-11-14 10:58 - 104200551 _____ C:\windows\SysWOW64\㔴훂Lř
2013-11-14 00:43 - 2013-11-14 00:43 - 104165720 _____ C:\windows\SysWOW64\᯾盵竀Å߿
2013-11-13 21:40 - 2013-11-13 21:40 - 00065560 _____ C:\Users\X\Downloads\NETGEAR_DG834Gv5.cfg
2013-11-13 16:42 - 2013-11-13 16:42 - 104010312 _____ C:\windows\SysWOW64\᯾睾몀Ê߿
2013-11-13 14:24 - 2013-11-13 14:24 - 104010312 _____ C:\windows\SysWOW64\᯾眠뢐9߿
2013-11-13 00:40 - 2013-11-13 00:40 - 103988193 _____ C:\windows\SysWOW64\᯾直窐Á߿
2013-11-13 00:38 - 2013-11-13 00:38 - 00281232 _____ C:\windows\Minidump\111313-22292-01.dmp
2013-11-12 20:38 - 2013-11-12 20:38 - 103974937 _____ C:\windows\SysWOW64\᯾眘撈İ߿
2013-11-11 23:56 - 2013-11-12 01:56 - 103792856 _____ C:\windows\SysWOW64\᯾瞱䏰ĵ߿
2013-11-11 22:04 - 2013-11-11 22:18 - 00040960 _____ C:\Users\X\Desktop\HRM_Mitarbeiterbefragung 2.xls
2013-11-11 21:56 - 2013-11-11 21:56 - 103792856 _____ C:\windows\SysWOW64\冿㋆Lʼn
2013-11-11 21:48 - 2013-11-11 21:48 - 00061989 _____ C:\Users\X\Downloads\HRM_Mitarbeiterbefragung.xlsx
2013-11-11 17:54 - 2013-11-11 17:54 - 103792856 _____ C:\windows\SysWOW64\㷃欒Læ
2013-11-11 09:08 - 2013-11-11 09:08 - 103681534 _____ C:\windows\SysWOW64\᯾盽表å߿
2013-11-10 21:25 - 2013-11-10 21:25 - 00021917 _____ C:\Users\X\Desktop\Kultur 2.odt
2013-11-10 17:02 - 2013-11-10 17:02 - 00387264 _____ C:\windows\Minidump\111013-22370-01.dmp
2013-11-10 15:09 - 2013-11-10 15:09 - 103467942 _____ C:\windows\SysWOW64\︝L£
2013-11-10 01:13 - 2013-11-10 01:13 - 103387443 _____ C:\windows\SysWOW64\᯾瞒俨Į߿
2013-11-09 23:11 - 2013-11-09 23:12 - 00961304 _____ C:\windows\Minidump\110913-21512-01.dmp
2013-11-08 22:49 - 2013-11-08 22:49 - 103316092 _____ C:\windows\SysWOW64\᯾眭ꡀĒ߿
2013-11-08 14:25 - 2013-11-08 14:25 - 103148646 _____ C:\windows\SysWOW64\楧гLŲ
2013-11-07 16:59 - 2013-11-07 21:18 - 103000967 _____ C:\windows\SysWOW64\᯾瞔睸Ù߿
2013-11-06 16:17 - 2013-11-06 16:17 - 102781840 _____ C:\windows\SysWOW64\᯾盺⧈Đ߿
2013-11-06 12:01 - 2013-11-06 14:01 - 102722523 _____ C:\windows\SysWOW64\ꔌ뛚LŘ
2013-11-06 00:34 - 2013-11-06 00:34 - 105119039 _____ C:\windows\SysWOW64\옝㫃Lä
2013-11-05 19:03 - 2013-11-05 19:03 - 00003395 _____ C:\Users\X\Downloads\Online-Tests.zip
2013-11-05 17:20 - 2013-11-05 17:20 - 00985912 _____ C:\windows\Minidump\110513-21184-01.dmp
2013-11-05 13:33 - 2013-11-05 13:33 - 105043933 _____ C:\windows\SysWOW64\᯾眛珈ô߿
2013-11-04 23:39 - 2013-11-04 23:39 - 105007987 _____ C:\windows\SysWOW64\᯾睧儐Ú߿
2013-11-04 19:00 - 2013-11-04 19:00 - 00000299 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk
2013-11-04 18:47 - 2013-11-04 18:57 - 00000000 ____D C:\Users\X\Documents\ALT
2013-11-04 13:04 - 2013-11-04 13:04 - 00989328 _____ C:\windows\Minidump\110413-21200-01.dmp
2013-11-04 11:52 - 2013-11-04 11:52 - 104867914 _____ C:\windows\SysWOW64\걓ᄤLž
2013-11-03 20:52 - 2013-11-03 20:52 - 104814100 _____ C:\windows\SysWOW64\㡩❏Lœ
2013-11-03 18:03 - 2013-11-03 18:03 - 00000000 ____D C:\Users\X\Documents\R
2013-11-03 14:17 - 2013-11-03 14:17 - 104760586 _____ C:\windows\SysWOW64\쬅䥚LƆ
2013-11-02 19:34 - 2013-11-02 19:34 - 104684788 _____ C:\windows\SysWOW64\᯾眤둀ę߿
2013-11-02 19:13 - 2013-11-02 19:13 - 00012102 _____ C:\Users\X\AppData\Local\recently-used.xbel
2013-11-02 15:28 - 2013-11-02 17:35 - 104684788 _____ C:\windows\SysWOW64\ꡤ甊LƋ
2013-11-01 20:48 - 2013-11-01 20:48 - 104569497 _____ C:\windows\SysWOW64\᯾盹∀]߿
2013-11-01 03:22 - 2013-11-01 03:22 - 00027032 _____ (TOSHIBA Corporation) C:\windows\system32\Drivers\tosrfec.sys
2013-10-31 23:36 - 2013-10-31 23:36 - 104470377 _____ C:\windows\SysWOW64\�LÆ
2013-10-31 20:06 - 2013-10-31 20:07 - 00983200 _____ C:\windows\Minidump\103113-20950-01.dmp
2013-10-31 15:34 - 2013-10-31 15:34 - 00034707 _____ C:\Users\X\Documents\.RData
2013-10-31 14:45 - 2013-10-31 14:45 - 104348737 _____ C:\windows\SysWOW64\冿燝LŌ
2013-10-31 14:35 - 2013-10-31 15:40 - 00000000 ____D C:\wsp
2013-10-31 14:21 - 2013-10-31 14:21 - 00021827 _____ C:\wsp.zip
2013-10-30 20:27 - 2013-10-30 20:27 - 104193179 _____ C:\windows\SysWOW64\᯾眘聐Ī߿
2013-10-29 10:04 - 2013-10-29 10:04 - 103932228 _____ C:\windows\SysWOW64\֏澎LŇ
2013-10-28 13:00 - 2013-10-28 13:00 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung(1).ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 03063296 _____ C:\Users\X\Downloads\Innovation im Tourismus.ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung.ppt
2013-10-28 11:51 - 2013-10-28 11:51 - 00084990 _____ C:\Users\X\Downloads\D1 (2).csv
2013-10-28 11:46 - 2013-10-28 11:46 - 00085517 _____ C:\Users\X\Downloads\D1 (1).csv
2013-10-28 11:41 - 2013-10-28 11:41 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964 (1).xls
2013-10-28 11:40 - 2013-10-28 11:40 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964.xls
2013-10-28 11:36 - 2013-10-28 11:36 - 00000000 ____D C:\ProgramData\Oracle
2013-10-28 11:33 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-28 11:33 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-10-28 11:33 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-10-28 11:33 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-10-28 11:32 - 2013-10-28 11:33 - 00004886 _____ C:\windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-28 11:24 - 2013-10-28 11:24 - 00040448 _____ C:\Users\X\Downloads\236258_teams-of-the-german-bundesliga-by-brand-value.xls
2013-10-28 10:58 - 2013-10-28 11:21 - 00000000 ____D C:\FPM
2013-10-28 10:52 - 2013-10-28 10:52 - 00022841 _____ C:\Users\X\Downloads\D1.csv
2013-10-28 10:48 - 2013-10-28 10:48 - 01910272 _____ C:\Users\X\Downloads\soccer---statista-dossier-2013.ppt
2013-10-28 02:40 - 2013-10-28 02:40 - 103622390 _____ C:\windows\SysWOW64\�けLÊ
2013-10-27 11:43 - 2013-10-27 11:44 - 30694824 _____ (Oracle Corporation) C:\Users\X\Downloads\jre-7u45-windows-x64.exe
2013-10-25 13:45 - 2013-10-25 13:45 - 102975063 _____ C:\windows\SysWOW64\㲇熏Ls
2013-10-25 00:51 - 2013-10-30 21:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-24 19:44 - 2013-10-24 19:44 - 102837954 _____ C:\windows\SysWOW64\䢀L×
2013-10-24 11:42 - 2013-10-24 11:42 - 102787172 _____ C:\windows\SysWOW64\᯾睆璸ē߿
2013-10-24 09:00 - 2013-10-24 09:00 - 102758948 _____ C:\windows\SysWOW64\᯾矨濰Ģ߿
2013-10-23 09:46 - 2013-10-23 09:46 - 102541796 _____ C:\windows\SysWOW64\᯾瞳蕀Ĩ߿
2013-10-23 00:14 - 2013-10-23 00:14 - 00000000 ____D C:\Users\X\AppData\Roaming\RStudio
2013-10-23 00:03 - 2013-10-23 00:05 - 54079987 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-Installer 3.0.1.exe
2013-10-23 00:03 - 2013-10-23 00:03 - 34085760 _____ C:\Users\Renate\Downloads\R-Studio Installer 0.97.551.exe
2013-10-22 15:01 - 2013-10-22 15:01 - 102329055 _____ C:\windows\SysWOW64\᪣瓻Lĩ
2013-10-20 18:34 - 2013-10-20 18:34 - 102068998 _____ C:\windows\SysWOW64\ာꖭL¢
2013-10-20 14:35 - 2013-10-20 14:35 - 00978624 _____ C:\windows\Minidump\102013-24304-01.dmp
2013-10-20 13:27 - 2013-10-20 13:27 - 102034533 _____ C:\windows\SysWOW64\ﭵLĊ
2013-10-19 19:41 - 2013-10-19 19:41 - 00707880 _____ C:\Users\X\Downloads\DownloadManagerSetup.exe
2013-10-18 19:42 - 2013-10-18 23:46 - 00017054 _____ C:\Users\X\Desktop\Stundenplan.ods
2013-10-18 19:35 - 2013-10-18 19:35 - 00008584 _____ C:\Users\X\Downloads\Excel-Vorlage-_Stundenplan.zip
2013-10-18 19:34 - 2013-10-18 19:34 - 00013536 _____ C:\Users\X\Downloads\stundenplan_v1-2.odt
2013-10-18 18:52 - 2013-10-19 13:18 - 101916422 _____ C:\windows\SysWOW64\�쉗L©
2013-10-18 15:46 - 2013-10-18 15:46 - 00000000 ____D C:\Users\X\Desktop\VPN Client
2013-10-18 15:39 - 2013-10-18 15:39 - 00000000 ____D C:\Users\X\AppData\Local\Shrew Soft VPN
2013-10-18 15:39 - 2013-10-18 15:39 - 00000000 ____D C:\ProgramData\Shrew Soft VPN
2013-10-18 15:38 - 2013-10-18 15:38 - 00009135 _____ C:\install.log
2013-10-18 15:08 - 2013-10-18 15:08 - 00000000 ____D C:\Program Files\TAP-Windows
2013-10-18 15:07 - 2013-10-18 15:09 - 00000000 ____D C:\Program Files (x86)\OpenVPN
2013-10-18 15:07 - 2013-10-18 14:55 - 01737363 _____ C:\Users\X\Desktop\OpenVPN-Client-fuer-Windows-2014-12-29-1101.exe

==================== One Month Modified Files and Folders =======

2013-11-17 17:02 - 2013-11-17 17:01 - 00019948 _____ C:\Users\X\Downloads\FRST.txt
2013-11-17 17:01 - 2013-11-17 17:01 - 00000000 ____D C:\FRST
2013-11-17 17:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2013-11-17 16:52 - 2013-03-05 14:12 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-17 16:52 - 2013-03-01 20:23 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3327028523-651003497-3907724089-1001
2013-11-17 16:47 - 2013-11-17 16:47 - 01958026 _____ (Farbar) C:\Users\X\Downloads\FRST64.exe
2013-11-17 16:41 - 2013-11-17 16:41 - 104695876 _____ C:\windows\SysWOW64\ﳿⴴL…
2013-11-17 16:39 - 2013-07-08 00:24 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-17 16:33 - 2013-03-02 00:19 - 00000000 ____D C:\Users\X\AppData\Roaming\Skype
2013-11-17 15:05 - 2013-07-22 18:43 - 00000000 ____D C:\Users\X\AppData\Roaming\Dropbox
2013-11-17 15:04 - 2013-07-22 18:47 - 00000000 ___RD C:\Users\X\Dropbox
2013-11-17 15:04 - 2013-05-01 18:59 - 00049258 _____ C:\ProgramData\lxecscan.log
2013-11-17 15:03 - 2013-07-08 00:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-17 15:02 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-17 14:15 - 2013-11-17 14:14 - 00916240 _____ C:\windows\Minidump\111713-32682-01.dmp
2013-11-17 14:14 - 2013-11-17 14:14 - 00444464 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 14:14 - 2013-05-21 00:53 - 559753609 _____ C:\windows\MEMORY.DMP
2013-11-17 14:14 - 2013-04-09 19:26 - 00000000 ____D C:\windows\Minidump
2013-11-17 14:00 - 2013-03-01 18:15 - 01308340 _____ C:\windows\WindowsUpdate.log
2013-11-17 13:35 - 2013-11-17 13:35 - 104641146 _____ C:\windows\SysWOW64\᯾瞉ℐ™߿
2013-11-17 13:18 - 2013-03-07 21:03 - 00000000 ____D C:\Users\X\.gimp-2.8
2013-11-17 12:55 - 2013-11-17 12:50 - 00017018 _____ C:\Users\X\Desktop\Anschreiben.odt
2013-11-17 11:41 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat
2013-11-17 11:41 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat
2013-11-17 11:41 - 2012-07-26 08:28 - 01745416 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-17 11:36 - 2012-07-26 06:26 - 01048576 ___SH C:\windows\system32\config\BBI
2013-11-17 11:35 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData
2013-11-17 11:35 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore
2013-11-17 04:08 - 2013-03-01 20:24 - 00000000 ____D C:\Users\X\AppData\Local\DoNotTrackPlus
2013-11-16 22:39 - 2013-11-16 22:39 - 104637397 _____ C:\windows\SysWOW64\촫ꟼLĬ
2013-11-16 14:41 - 2013-03-05 00:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-16 13:49 - 2013-11-16 13:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 13:29 - 2013-04-12 19:55 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-16 13:23 - 2013-08-16 10:54 - 00000000 ____D C:\windows\system32\MRT
2013-11-16 13:20 - 2013-03-02 21:44 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-11-16 01:51 - 2013-11-16 01:51 - 104513208 _____ C:\windows\SysWOW64\΅魱L¡
2013-11-15 19:27 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-11-15 04:06 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-11-15 02:27 - 2012-07-26 06:26 - 00000199 _____ C:\windows\win.ini
2013-11-14 22:09 - 2013-11-14 22:09 - 104278918 _____ C:\windows\SysWOW64\㿔ߏLû
2013-11-14 14:47 - 2013-11-14 14:47 - 00000000 ____D C:\Users\Administrator\Desktop\RStudio
2013-11-14 14:47 - 2013-11-14 14:46 - 00000000 ____D C:\Users\X\Desktop\RStudio
2013-11-14 14:33 - 2013-11-14 14:33 - 00000000 ____D C:\Program Files\RStudio
2013-11-14 14:31 - 2013-11-14 14:30 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551(1).exe
2013-11-14 14:28 - 2013-11-14 14:28 - 00001043 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001035 _____ C:\Users\Public\Desktop\R i386 3.0.2.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001028 _____ C:\Users\Public\Desktop\R x64 3.0.2.lnk
2013-11-14 14:24 - 2013-11-14 14:24 - 00000000 ____D C:\Program Files\R
2013-11-14 14:24 - 2013-11-14 14:23 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win(1).exe
2013-11-14 14:12 - 2013-11-14 14:11 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win.exe
2013-11-14 14:07 - 2013-11-14 14:06 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551.exe
2013-11-14 10:58 - 2013-11-14 10:58 - 104200551 _____ C:\windows\SysWOW64\㔴훂Lř
2013-11-14 00:43 - 2013-11-14 00:43 - 104165720 _____ C:\windows\SysWOW64\᯾盵竀Å߿
2013-11-13 22:48 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF
2013-11-13 21:40 - 2013-11-13 21:40 - 00065560 _____ C:\Users\X\Downloads\NETGEAR_DG834Gv5.cfg
2013-11-13 16:42 - 2013-11-13 16:42 - 104010312 _____ C:\windows\SysWOW64\᯾睾몀Ê߿
2013-11-13 14:24 - 2013-11-13 14:24 - 104010312 _____ C:\windows\SysWOW64\᯾眠뢐9߿
2013-11-13 00:40 - 2013-11-13 00:40 - 103988193 _____ C:\windows\SysWOW64\᯾直窐Á߿
2013-11-13 00:38 - 2013-11-13 00:38 - 00281232 _____ C:\windows\Minidump\111313-22292-01.dmp
2013-11-12 20:38 - 2013-11-12 20:38 - 103974937 _____ C:\windows\SysWOW64\᯾眘撈İ߿
2013-11-12 01:56 - 2013-11-11 23:56 - 103792856 _____ C:\windows\SysWOW64\᯾瞱䏰ĵ߿
2013-11-12 00:48 - 2013-02-19 00:07 - 00000000 ____D C:\Users\X\AppData\Local\Packages
2013-11-11 22:18 - 2013-11-11 22:04 - 00040960 _____ C:\Users\X\Desktop\HRM_Mitarbeiterbefragung 2.xls
2013-11-11 21:56 - 2013-11-11 21:56 - 103792856 _____ C:\windows\SysWOW64\冿㋆Lʼn
2013-11-11 21:48 - 2013-11-11 21:48 - 00061989 _____ C:\Users\X\Downloads\HRM_Mitarbeiterbefragung.xlsx
2013-11-11 17:54 - 2013-11-11 17:54 - 103792856 _____ C:\windows\SysWOW64\㷃欒Læ
2013-11-11 09:08 - 2013-11-11 09:08 - 103681534 _____ C:\windows\SysWOW64\᯾盽表å߿
2013-11-10 21:25 - 2013-11-10 21:25 - 00021917 _____ C:\Users\X\Desktop\Kultur 2.odt
2013-11-10 17:02 - 2013-11-10 17:02 - 00387264 _____ C:\windows\Minidump\111013-22370-01.dmp
2013-11-10 15:09 - 2013-11-10 15:09 - 103467942 _____ C:\windows\SysWOW64\︝L£
2013-11-10 01:13 - 2013-11-10 01:13 - 103387443 _____ C:\windows\SysWOW64\᯾瞒俨Į߿
2013-11-09 23:12 - 2013-11-09 23:11 - 00961304 _____ C:\windows\Minidump\110913-21512-01.dmp
2013-11-08 22:49 - 2013-11-08 22:49 - 103316092 _____ C:\windows\SysWOW64\᯾眭ꡀĒ߿
2013-11-08 14:25 - 2013-11-08 14:25 - 103148646 _____ C:\windows\SysWOW64\楧гLŲ
2013-11-08 11:30 - 2012-08-19 02:45 - 00025792 _____ C:\windows\PFRO.log
2013-11-07 21:18 - 2013-11-07 16:59 - 103000967 _____ C:\windows\SysWOW64\᯾瞔睸Ù߿
2013-11-06 16:17 - 2013-11-06 16:17 - 102781840 _____ C:\windows\SysWOW64\᯾盺⧈Đ߿
2013-11-06 14:01 - 2013-11-06 12:01 - 102722523 _____ C:\windows\SysWOW64\ꔌ뛚LŘ
2013-11-06 13:37 - 2013-03-02 00:18 - 00000000 ____D C:\ProgramData\Skype
2013-11-06 13:36 - 2013-03-02 00:18 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-06 00:34 - 2013-11-06 00:34 - 105119039 _____ C:\windows\SysWOW64\옝㫃Lä
2013-11-05 23:58 - 2013-11-15 17:51 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-05 23:58 - 2013-11-15 17:51 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-05 19:03 - 2013-11-05 19:03 - 00003395 _____ C:\Users\X\Downloads\Online-Tests.zip
2013-11-05 17:20 - 2013-11-05 17:20 - 00985912 _____ C:\windows\Minidump\110513-21184-01.dmp
2013-11-05 13:33 - 2013-11-05 13:33 - 105043933 _____ C:\windows\SysWOW64\᯾眛珈ô߿
2013-11-05 13:09 - 2013-03-01 18:15 - 00000000 ____D C:\Users\X
2013-11-04 23:39 - 2013-11-04 23:39 - 105007987 _____ C:\windows\SysWOW64\᯾睧儐Ú߿
2013-11-04 19:00 - 2013-11-04 19:00 - 00000299 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk
2013-11-04 18:57 - 2013-11-04 18:47 - 00000000 ____D C:\Users\X\Documents\ALT
2013-11-04 18:57 - 2013-03-03 01:04 - 00000000 ____D C:\Users\X\Documents\Dokumente
2013-11-04 13:04 - 2013-11-04 13:04 - 00989328 _____ C:\windows\Minidump\110413-21200-01.dmp
2013-11-04 11:59 - 2012-07-26 08:21 - 00038658 _____ C:\windows\setupact.log
2013-11-04 11:52 - 2013-11-04 11:52 - 104867914 _____ C:\windows\SysWOW64\걓ᄤLž
2013-11-03 20:52 - 2013-11-03 20:52 - 104814100 _____ C:\windows\SysWOW64\㡩❏Lœ
2013-11-03 18:03 - 2013-11-03 18:03 - 00000000 ____D C:\Users\X\Documents\R
2013-11-03 14:17 - 2013-11-03 14:17 - 104760586 _____ C:\windows\SysWOW64\쬅䥚LƆ
2013-11-02 21:01 - 2013-07-22 18:46 - 00000000 ____D C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-02 21:01 - 2013-03-01 18:21 - 00000000 ___RD C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-02 19:34 - 2013-11-02 19:34 - 104684788 _____ C:\windows\SysWOW64\᯾眤둀ę߿
2013-11-02 19:13 - 2013-11-02 19:13 - 00012102 _____ C:\Users\X\AppData\Local\recently-used.xbel
2013-11-02 17:35 - 2013-11-02 15:28 - 104684788 _____ C:\windows\SysWOW64\ꡤ甊LƋ
2013-11-01 20:48 - 2013-11-01 20:48 - 104569497 _____ C:\windows\SysWOW64\᯾盹∀]߿
2013-11-01 03:22 - 2013-11-01 03:22 - 00027032 _____ (TOSHIBA Corporation) C:\windows\system32\Drivers\tosrfec.sys
2013-10-31 23:36 - 2013-10-31 23:36 - 104470377 _____ C:\windows\SysWOW64\�LÆ
2013-10-31 20:07 - 2013-10-31 20:06 - 00983200 _____ C:\windows\Minidump\103113-20950-01.dmp
2013-10-31 15:40 - 2013-10-31 14:35 - 00000000 ____D C:\wsp
2013-10-31 15:34 - 2013-10-31 15:34 - 00034707 _____ C:\Users\X\Documents\.RData
2013-10-31 14:45 - 2013-10-31 14:45 - 104348737 _____ C:\windows\SysWOW64\冿燝LŌ
2013-10-31 14:21 - 2013-10-31 14:21 - 00021827 _____ C:\wsp.zip
2013-10-30 21:20 - 2013-10-25 00:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 20:27 - 2013-10-30 20:27 - 104193179 _____ C:\windows\SysWOW64\᯾眘聐Ī߿
2013-10-29 10:04 - 2013-10-29 10:04 - 103932228 _____ C:\windows\SysWOW64\֏澎LŇ
2013-10-28 13:00 - 2013-10-28 13:00 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung(1).ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 03063296 _____ C:\Users\X\Downloads\Innovation im Tourismus.ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung.ppt
2013-10-28 11:51 - 2013-10-28 11:51 - 00084990 _____ C:\Users\X\Downloads\D1 (2).csv
2013-10-28 11:46 - 2013-10-28 11:46 - 00085517 _____ C:\Users\X\Downloads\D1 (1).csv
2013-10-28 11:41 - 2013-10-28 11:41 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964 (1).xls
2013-10-28 11:40 - 2013-10-28 11:40 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964.xls
2013-10-28 11:36 - 2013-10-28 11:36 - 00000000 ____D C:\ProgramData\Oracle
2013-10-28 11:33 - 2013-10-28 11:32 - 00004886 _____ C:\windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-28 11:33 - 2013-03-17 01:12 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-28 11:24 - 2013-10-28 11:24 - 00040448 _____ C:\Users\X\Downloads\236258_teams-of-the-german-bundesliga-by-brand-value.xls
2013-10-28 11:21 - 2013-10-28 10:58 - 00000000 ____D C:\FPM
2013-10-28 10:52 - 2013-10-28 10:52 - 00022841 _____ C:\Users\X\Downloads\D1.csv
2013-10-28 10:48 - 2013-10-28 10:48 - 01910272 _____ C:\Users\X\Downloads\soccer---statista-dossier-2013.ppt
2013-10-28 02:40 - 2013-10-28 02:40 - 103622390 _____ C:\windows\SysWOW64\�けLÊ
2013-10-27 11:44 - 2013-10-27 11:43 - 30694824 _____ (Oracle Corporation) C:\Users\Renate\Downloads\jre-7u45-windows-x64.exe
2013-10-25 13:45 - 2013-10-25 13:45 - 102975063 _____ C:\windows\SysWOW64\㲇熏Ls
2013-10-24 19:44 - 2013-10-24 19:44 - 102837954 _____ C:\windows\SysWOW64\䢀L×
2013-10-24 11:42 - 2013-10-24 11:42 - 102787172 _____ C:\windows\SysWOW64\᯾睆璸ē߿
2013-10-24 09:00 - 2013-10-24 09:00 - 102758948 _____ C:\windows\SysWOW64\᯾矨濰Ģ߿
2013-10-23 17:11 - 2013-05-01 19:10 - 00006740 _____ C:\ProgramData\lxecJSW.log
2013-10-23 17:11 - 2013-05-01 19:02 - 00000000 ____D C:\ProgramData\Lx_cats
2013-10-23 09:46 - 2013-10-23 09:46 - 102541796 _____ C:\windows\SysWOW64\᯾瞳蕀Ĩ߿
2013-10-23 00:14 - 2013-10-23 00:14 - 00000000 ____D C:\Users\X\AppData\Roaming\RStudio
2013-10-23 00:05 - 2013-10-23 00:03 - 54079987 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-Installer 3.0.1.exe
2013-10-23 00:03 - 2013-10-23 00:03 - 34085760 _____ C:\Users\X\Downloads\R-Studio Installer 0.97.551.exe
2013-10-22 15:01 - 2013-10-22 15:01 - 102329055 _____ C:\windows\SysWOW64\᪣瓻Lĩ
2013-10-20 18:34 - 2013-10-20 18:34 - 102068998 _____ C:\windows\SysWOW64\ာꖭL¢
2013-10-20 14:35 - 2013-10-20 14:35 - 00978624 _____ C:\windows\Minidump\102013-24304-01.dmp
2013-10-20 13:27 - 2013-10-20 13:27 - 102034533 _____ C:\windows\SysWOW64\ﭵLĊ
2013-10-19 21:54 - 2013-03-01 18:22 - 00000000 ____D C:\Users\X\AppData\Local\TOSHIBA
2013-10-19 19:41 - 2013-10-19 19:41 - 00707880 _____ C:\Users\X\Downloads\DownloadManagerSetup.exe
2013-10-19 13:18 - 2013-10-18 18:52 - 101916422 _____ C:\windows\SysWOW64\�쉗L©
2013-10-18 23:46 - 2013-10-18 19:42 - 00017054 _____ C:\Users\X\Desktop\Stundenplan.ods
2013-10-18 19:35 - 2013-10-18 19:35 - 00008584 _____ C:\Users\X\Downloads\Excel-Vorlage-_Stundenplan.zip
2013-10-18 19:34 - 2013-10-18 19:34 - 00013536 _____ C:\Users\X\Downloads\stundenplan_v1-2.odt
2013-10-18 15:46 - 2013-10-18 15:46 - 00000000 ____D C:\Users\X\Desktop\VPN Client
2013-10-18 15:39 - 2013-10-18 15:39 - 00000000 ____D C:\Users\X\AppData\Local\Shrew Soft VPN
2013-10-18 15:39 - 2013-10-18 15:39 - 00000000 ____D C:\ProgramData\Shrew Soft VPN
2013-10-18 15:39 - 2013-10-17 11:53 - 00000000 ____D C:\Program Files\ShrewSoft
2013-10-18 15:38 - 2013-10-18 15:38 - 00009135 _____ C:\install.log
2013-10-18 15:09 - 2013-10-18 15:07 - 00000000 ____D C:\Program Files (x86)\OpenVPN
2013-10-18 15:08 - 2013-10-18 15:08 - 00000000 ____D C:\Program Files\TAP-Windows
2013-10-18 14:55 - 2013-10-18 15:07 - 01737363 _____ C:\Users\X\Desktop\OpenVPN-Client-fuer-Windows-2014-12-29-1101.exe

Some content of TEMP:
====================
C:\Users\X\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\X\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\X\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\X\AppData\Local\Temp\NEW98EE.tmp.exe
C:\Users\X\AppData\Local\Temp\ose00000.exe
C:\Users\X\AppData\Local\Temp\setup.exe
C:\Users\X\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-09 20:41

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013 02
Ran by X at 2013-11-17 17:03:51
Running from C:\Users\X\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
AMD Accelerated Video Transcoding (Version: 12.5.100.20808)
AMD APP SDK Runtime (Version: 10.0.938.2)
AMD Catalyst Install Manager (Version: 8.0.881.0)
AMD Quick Stream (Version: 3.3.26.0)
AMD VISION Engine Control Center (x32 Version: 2012.0808.1024.16666)
Ask Toolbar (x32 Version: 1.15.26.0)
Avira Internet Security (x32 Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.4.37949)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0808.1024.16666)
Catalyst Control Center Localization All (x32 Version: 2012.0808.1024.16666)
CCC Help Chinese Standard (x32 Version: 2012.0808.1023.16666)
CCC Help Chinese Traditional (x32 Version: 2012.0808.1023.16666)
CCC Help Czech (x32 Version: 2012.0808.1023.16666)
CCC Help Danish (x32 Version: 2012.0808.1023.16666)
CCC Help Dutch (x32 Version: 2012.0808.1023.16666)
CCC Help English (x32 Version: 2012.0808.1023.16666)
CCC Help Finnish (x32 Version: 2012.0808.1023.16666)
CCC Help French (x32 Version: 2012.0808.1023.16666)
CCC Help German (x32 Version: 2012.0808.1023.16666)
CCC Help Greek (x32 Version: 2012.0808.1023.16666)
CCC Help Hungarian (x32 Version: 2012.0808.1023.16666)
CCC Help Italian (x32 Version: 2012.0808.1023.16666)
CCC Help Japanese (x32 Version: 2012.0808.1023.16666)
CCC Help Korean (x32 Version: 2012.0808.1023.16666)
CCC Help Norwegian (x32 Version: 2012.0808.1023.16666)
CCC Help Polish (x32 Version: 2012.0808.1023.16666)
CCC Help Portuguese (x32 Version: 2012.0808.1023.16666)
CCC Help Russian (x32 Version: 2012.0808.1023.16666)
CCC Help Spanish (x32 Version: 2012.0808.1023.16666)
CCC Help Swedish (x32 Version: 2012.0808.1023.16666)
CCC Help Thai (x32 Version: 2012.0808.1023.16666)
CCC Help Turkish (x32 Version: 2012.0808.1023.16666)
ccc-utility64 (Version: 2012.0808.1024.16666)
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition
Dropbox (HKCU Version: 2.4.6)
Free Alarm Clock 2.7.0 (x32 Version: 2.7)
Free PDF to Word Doc Converter v1.1 (x32 Version: 1.1)
Gameforge Live 1.0 "Legend" (x32 Version: 1.1.1724)
GIMP 2.8.4 (Version: 2.8.4)
Google Chrome (x32 Version: 31.0.1650.57)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (Version: 28.0.1313.0)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 24 (x32 Version: 6.0.240)
Lexmark Pro800-Pro900 Series
Lexware Info Service (x32 Version: 2.90.00.0009)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
McAfee Security Scan Plus (x32 Version: 3.0.285.6)
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017)
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017)
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017)
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017)
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Visio MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Visio Professional 2013 (Version: 15.0.4420.1017)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
OpenVPN 2.3.2-I003  (x32 Version: 2.3.2-I003)
Opera 12.16 (x32 Version: 12.16.1860)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017)
PDF24 Creator 5.3.0 (x32)
Premium Sound HD (Version: 1.12.4600)
QuickSteuer 2013 (x32 Version: 19.05.00.0029)
R for Windows 3.0.2 (Version: 3.0.2)
Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136)
Realtek WLAN Driver (x32 Version: 2.00.0020)
RStudio (x32 Version: 0.97.551)
Serif PhotoPlus X5 (x32 Version: 15.0.1.011)
Shape Collage (x32)
Shared C Run-time for x64 (Version: 10.0.0)
Shrew Soft VPN Client
Skype™ 6.10 (x32 Version: 6.10.104)
Synaptics Pointing Device Driver (Version: 16.2.10.3)
TAP-Windows 9.9.2 (Version: 9.9.2)
TIPP10 Version 2.1.0 (x32)
TOSHIBA Desktop Assist (Version: 1.00.0007.00002)
TOSHIBA eco Utility (Version: 2.0.0.6414)
TOSHIBA Function Key (Version: 1.00.6425)
TOSHIBA Manuals (x32 Version: 10.10)
Toshiba Password Utility (x32 Version: 2.00.910)
TOSHIBA PC Health Monitor (Version: 1.8.17.640104)
Toshiba Places Icon Utility (Version: 2.1.1)
TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005)
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.1.00)
TOSHIBA Service Station (Version: 2.4.4)
TOSHIBA System Driver (x32 Version: 1.00.0012)
TOSHIBA System Settings (x32 Version: 1.00.0002.32002)
Toshiba TEMPRO (x32 Version: 4.2.0)
TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A)
Unity Web Player (HKCU Version: )
Update for Microsoft Access 2013 (KB2768008) 64-Bit Edition
Update for Microsoft InfoPath 2013 (KB2752078) 64-Bit Edition
Update for Microsoft Lync 2013 (KB2817621) 64-Bit Edition
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition
Update for Microsoft Office 2013 (KB2726954) 64-Bit Edition
Update for Microsoft Office 2013 (KB2726996) 64-Bit Edition
Update for Microsoft Office 2013 (KB2738038) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760224) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760242) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760257) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760267) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760539) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760553) 64-Bit Edition
Update for Microsoft Office 2013 (KB2760610) 64-Bit Edition
Update for Microsoft Office 2013 (KB2767845) 64-Bit Edition
Update for Microsoft Office 2013 (KB2768016) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817309) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817311) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817314) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817316) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817490) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817626) 64-Bit Edition
Update for Microsoft Office 2013 (KB2817640) 64-Bit Edition
Update for Microsoft Office 2013 (KB2827225) 64-Bit Edition
Update for Microsoft Office 2013 (KB2827228) 64-Bit Edition
Update for Microsoft Office 2013 (KB2827230) 64-Bit Edition
Update for Microsoft Office 2013 (KB2827239) 64-Bit Edition
Update for Microsoft Office 2013 (KB2837649) 64-Bit Edition
Update for Microsoft OneNote 2013 (KB2837642) 64-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2726947) 64-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2817625) 64-Bit Edition
Update for Microsoft Project 2013 (KB2767859) 64-Bit Edition
Update for Microsoft Publisher 2013 (KB2752097) 64-Bit Edition
Update for Microsoft SkyDrive Pro (KB2837652) 64-Bit Edition
Update for Microsoft Visio 2013 (KB2752018) 64-Bit Edition
Update for Microsoft Visio 2013 (KB2810008) 64-Bit Edition
Update for Microsoft Visio Viewer 2013 (KB2768338) 64-Bit Edition
Update for Microsoft Word 2013 (KB2817631) 64-Bit Edition
Update for Microsoft Word 2013 (KB2837630) 64-Bit Edition
Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3)
Wise Folder Hider 1.32 (x32)

==================== Restore Points  =========================

29-10-2013 22:14:11 Geplanter Prüfpunkt
04-11-2013 21:00:42 Windows Update
14-11-2013 22:13:54 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {2042D8E8-33AE-4B11-913E-55BCD75DE081} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {22C9D532-1703-433A-93DD-499A4B5B9B31} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-10] (Toshiba Europe GmbH)
Task: {39EC13F4-C656-4AE3-A75C-98729631803B} - System32\Tasks\{9AA6FAD8-4B36-481A-96B3-C0F362D5535B} => C:\Program Files (x86)\Opera\opera.exe [2013-07-07] (Opera Software)
Task: {4897D8DD-FA38-4640-AEB0-ADC27746E771} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation)
Task: {5937C20A-0F27-4CCC-ADCF-62F8D650FB55} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\microsoft shared\OFFICE15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {7EFAD06F-55B8-4715-9D5F-C56AD14636A4} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {80B7FACF-7534-439B-9053-88D6E5C62BA1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {95E19AD2-8CB1-438A-8B68-554444B3970D} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-30] ()
Task: {982AD57C-F53F-46E3-9AD0-3305640722B8} - System32\Tasks\{401FFDD7-7721-4349-9A8F-265EC8C46A3E} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&page=tsProgressBar
Task: {C09D4B0C-2DFF-430E-84AC-E72B395AAE7D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-08] (Google Inc.)
Task: {C1E2078A-3464-4AF9-8286-46A4668DDAE1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-08] (Google Inc.)
Task: {E0F9D853-9BBF-43FB-B183-D7A03098DD14} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {EF7E4C2D-3DAE-4179-8A5C-B096A1E0B409} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-08] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-06-01 22:20 - 2013-06-01 22:20 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 03:13 - 2012-08-14 03:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-07-31 08:11 - 2012-07-31 08:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2012-08-08 18:22 - 2012-08-08 18:22 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-03-01 20:11 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-03-01 20:11 - 2012-09-14 15:16 - 00447848 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\libxml2.dll
2013-03-01 20:11 - 2012-09-14 15:16 - 00060264 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\cares.dll
2013-05-01 18:59 - 2010-04-01 11:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecscw.dll
2013-05-01 18:59 - 2009-05-27 06:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecdatr.dll
2013-05-01 18:59 - 2010-04-01 11:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecDRS.dll
2013-05-01 18:59 - 2009-03-09 23:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxeccaps.dll
2013-05-01 18:58 - 2009-02-20 02:48 - 00381440 _____ () C:\windows\SYSTEM32\lxecsm.dll
2013-05-01 18:58 - 2009-04-28 01:56 - 00024064 _____ () C:\windows\system32\lxecsmr.dll
2013-05-01 18:59 - 2010-04-05 04:56 - 00716954 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Epwizard.DLL
2013-05-01 18:59 - 2010-04-05 04:55 - 00159890 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\customui.dll
2013-05-01 18:59 - 2010-04-05 04:54 - 00123033 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Eputil.DLL
2013-05-01 18:59 - 2010-04-05 04:55 - 00061604 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Epfunct.DLL
2013-05-01 18:59 - 2010-04-05 04:54 - 00143502 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Imagutil.DLL
2013-05-01 18:59 - 2009-06-23 05:09 - 02203648 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\EPWizRes.dll
2013-05-01 18:59 - 2009-06-23 05:10 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epstring.dll
2013-05-01 18:59 - 2009-06-23 05:11 - 00102400 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\EPOEMDll.dll
2013-05-01 18:59 - 2009-04-07 13:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\iptk.dll
2013-05-01 18:59 - 2009-03-02 08:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecptp.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Renate\AppData\Roaming\Dropbox\bin\libcef.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-11-16 13:49 - 2013-11-16 13:49 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Shrew Soft Virtual Adapter
Description: Shrew Soft Virtual Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Shrew Soft
Service: vnet
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/17/2013 11:56:04 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: soffice.bin, Version: 3.4.9593.500, Zeitstempel: 0x5028bfc0
Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.2.9200.16622, Zeitstempel: 0x519e974e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001f035
ID des fehlerhaften Prozesses: 0x134c
Startzeit der fehlerhaften Anwendung: 0xsoffice.bin0
Pfad der fehlerhaften Anwendung: soffice.bin1
Pfad des fehlerhaften Moduls: soffice.bin2
Berichtskennung: soffice.bin3
Vollständiger Name des fehlerhaften Pakets: soffice.bin4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: soffice.bin5

Error: (11/17/2013 02:16:06 AM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (11/16/2013 08:20:21 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005

Error: (11/16/2013 01:20:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/16/2013 01:20:23 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/16/2013 01:20:21 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/16/2013 01:16:18 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "x64" des "processorArchitecture"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (11/16/2013 01:24:14 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005

Error: (11/16/2013 00:28:39 AM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (11/15/2013 05:59:51 PM) (Source: Office 2013 Licensing Service) (User: )
Description: Subscription licensing service failed: -1073418231


System errors:
=============
Error: (11/17/2013 03:02:38 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (11/17/2013 03:02:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxecCATSCustConnectService erreicht.

Error: (11/17/2013 03:02:23 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎11/‎17/‎2013 um 2:39:49 PM unerwartet heruntergefahren.

Error: (11/17/2013 02:15:30 PM) (Source: BugCheck) (User: )
Description: 0x0000009f (0x0000000000000003, 0xfffffa8006a0d060, 0xfffff800fbcd1770, 0xfffffa800bac3a80)C:\windows\MEMORY.DMP111713-32682-01

Error: (11/17/2013 02:15:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (11/17/2013 02:15:04 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxecCATSCustConnectService erreicht.

Error: (11/17/2013 02:14:49 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎11/‎17/‎2013 um 1:42:09 PM unerwartet heruntergefahren.

Error: (11/17/2013 11:37:03 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (11/17/2013 11:37:03 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxecCATSCustConnectService erreicht.

Error: (11/17/2013 11:34:05 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (11/17/2013 11:56:04 AM) (Source: Application Error)(User: )
Description: soffice.bin3.4.9593.5005028bfc0RPCRT4.dll6.2.9200.16622519e974ec00000050001f035134c01cee38140ffb7adC:\Program Files (x86)\OpenOffice.org 3\program\soffice.binC:\windows\SYSTEM32\RPCRT4.dllda073ee4-4f76-11e3-bf1d-4c72b9d5dda9

Error: (11/17/2013 02:16:06 AM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073418231

Error: (11/16/2013 08:20:21 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005

Error: (11/16/2013 01:20:24 PM) (Source: SideBySide)(User: )
Description: C:\Lexmark\drivers\Pro800\drivers\win_xp2k\x64\LXECsm64.dllC:\Lexmark\drivers\Pro800\drivers\win_xp2k\x64\LXECsm64.dll9

Error: (11/16/2013 01:20:23 PM) (Source: SideBySide)(User: )
Description: C:\Lexmark\drivers\Pro800\drivers\win_xp2k\i386\LXECsm.dllC:\Lexmark\drivers\Pro800\drivers\win_xp2k\i386\LXECsm.dll9

Error: (11/16/2013 01:20:21 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Lexmark\drivers\Pro800\Apps\HRS\LXECHiResScan.exe

Error: (11/16/2013 01:16:18 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityprocessorArchitecturex64C:\Program Files\R\R-3.0.2\Tcl\bin64\tk85.dllC:\Program Files\R\R-3.0.2\Tcl\bin64\tk85.dll9

Error: (11/16/2013 01:24:14 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005

Error: (11/16/2013 00:28:39 AM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073418231

Error: (11/15/2013 05:59:51 PM) (Source: Office 2013 Licensing Service)(User: )
Description: Subscription licensing service failed: -1073418231


==================== Memory info =========================== 

Percentage of memory in use: 25%
Total physical RAM: 7644.73 MB
Available physical RAM: 5684.61 MB
Total Pagefile: 15324.73 MB
Available Pagefile: 13130.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (TI30974100A) (Fixed) (Total:689.48 GB) (Free:621.9 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 00000000)

Partition: GPT Partition Type
==================== End Of Log ============================
         

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Ich traue mich an ComboFix nicht ran, geht es auch anders? Malewarebytes?


Ich bin leider ein kleiner "Angsthase" und wüsste nicht was ich machen sollte wenns doch nach einem Neustart nicht klappt. Danke!!

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

sorry, dass ich erst jetzt poste...

1.) Malewarebytes

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.19.10

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16736
X :: Y [Administrator]

19.11.2013 21:00:41
mbam-log-2013-11-19 (21-00-41).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 231555
Laufzeit: 9 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

2.)

# AdwCleaner v3.012 - Bericht erstellt am 19/11/2013 um 21:19:16
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : X - Y
# Gestartet von : C:\Users\X\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\foxydeal.sqlite
Datei Gefunden : C:\windows\System32\Tasks\Scheduled Update for Ask Toolbar
Ordner Gefunden C:\Program Files (x86)\Ask.com
Ordner Gefunden C:\Users\X\AppData\Local\AskToolbar
Ordner Gefunden C:\Users\X\AppData\Local\Temp\AskSearch
Ordner Gefunden C:\Users\X\AppData\LocalLow\AskToolbar
Ordner Gefunden C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gefunden : HKCU\Software\Ask.com
Schlüssel Gefunden : HKCU\Software\AskToolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : [x64] HKCU\Software\Ask.com
Schlüssel Gefunden : [x64] HKCU\Software\AskToolbar
Schlüssel Gefunden : HKLM\Software\AskToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v25.0.1 (de)

[ Datei : C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\prefs.js ]


-\\ Google Chrome v31.0.1650.57

[ Datei : C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6879 octets] - [19/11/2013 21:19:16]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [6939 octets] ##########
         

# AdwCleaner v3.012 - Bericht erstellt am 19/11/2013 um 21:21:28
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : X - Y
# Gestartet von : C:\Users\X\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\X\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\X\AppData\Local\Temp\AskSearch
Ordner Gelöscht : C:\Users\X\AppData\LocalLow\AskToolbar
Datei Gelöscht : C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\foxydeal.sqlite
Datei Gelöscht : C:\windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{39B217B4-8C69-4E45-A8DC-8CC4DAD3CF0A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CB4CE45-8849-4638-9226-D6B615A15827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{43AB7B5D-4C40-4103-A549-7002A116A7D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{996ED20F-A740-47A2-A7EF-9620D422BB4E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v25.0.1 (de)

[ Datei : C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\prefs.js ]


-\\ Google Chrome v31.0.1650.57

[ Datei : C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [7039 octets] - [19/11/2013 21:19:16]
AdwCleaner[S0].txt - [6855 octets] - [19/11/2013 21:21:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6915 octets] ##########
         

3.) JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 8 x64
Ran by X on 19.11.2013 at 21:46:01,17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F05D0A4E-5319-4AF1-89A4-AF08AE467486}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\X\AppData\Roaming\mozilla\firefox\profiles\7p36g2ql.default\minidumps [97 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.11.2013 at 21:55:47,75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

3.) FRST


FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by X (administrator) on Y on 19-11-2013 22:07:27
Running from C:\Users\X\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
(Microsoft Corporation) C:\windows\system32\dashost.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
( ) C:\windows\system32\lxeccoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
() C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
() C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(Dropbox, Inc.) C:\Users\X\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\X\Downloads\FRST64(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223245 2012-07-27] ()
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [lxecmon.exe] - C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe [772712 2013-01-23] ()
HKLM\...\Run: [EzPrint] - C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe [150264 2013-01-23] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [Lync] - C:\Program Files\Microsoft Office\Office15\lync.exe [22332576 2013-10-21] (Microsoft Corporation)
HKCU\...\Run: [FreeAC] - C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1328976 2012-04-25] (Comfort Software Group)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes
HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-02-19] (Geek Software GmbH)
HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Administrator\...\Run: [] - [x]
HKU\Administrator\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
Startup: C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\X\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
SearchScopes: HKLM - DefaultScope {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {23655BA9-296D-4937-9388-998AC370C18A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - {23655BA9-296D-4937-9388-998AC370C18A} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u24-windows-i586.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{F4112086-05A5-45AF-9E45-057616192A47}: [NameServer]141.78.7.250,141.78.7.200

FireFox:
========
FF ProfilePath: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\X\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\ich@maltegoetz.de
FF Extension: YouTube Unblocker - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\youtubeunblocker@unblocker.yt
FF Extension: jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi
FF Extension: youtube2mp3 - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\7p36g2ql.default\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Microsoft Office 2013) - C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2013) - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Unity Player) - C:\Users\X\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\windows\SysWOW64\npDeployJava1.dll No File
CHR Extension: (Google Docs) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Timer) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\edebbhkhcaafmolanelponjjanocpacd\1.8.0.4_0
CHR Extension: (Google Wallet) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
S2 lxecCATSCustConnectService; C:\windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
R2 lxec_device; C:\windows\system32\lxeccoms.exe [1052328 2010-04-14] ( )
R2 lxec_device; C:\windows\SysWow64\lxeccoms.exe [598696 2010-04-14] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-10] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2013-03-02] (Avira GmbH)
R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2013-03-02] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-03-21] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-19 22:06 - 2013-11-19 22:06 - 01957964 _____ (Farbar) C:\Users\X\Downloads\FRST64(1).exe
2013-11-19 21:55 - 2013-11-19 21:55 - 00001019 _____ C:\Users\X\Desktop\JRT.txt
2013-11-19 21:45 - 2013-11-19 21:45 - 00000000 ____D C:\windows\ERUNT
2013-11-19 21:43 - 2013-11-19 21:43 - 01034531 _____ (Thisisu) C:\Users\X\Downloads\JRT.exe
2013-11-19 21:18 - 2013-11-19 21:39 - 00000000 ____D C:\AdwCleaner
2013-11-19 21:17 - 2013-11-19 21:17 - 01085542 _____ C:\Users\X\Downloads\adwcleaner.exe
2013-11-19 20:57 - 2013-11-19 20:57 - 00001120 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-19 20:56 - 2013-11-19 20:56 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\X\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-19 05:58 - 2013-11-19 05:58 - 00006496 _____ C:\Users\X\AppData\Local\recently-used.xbel
2013-11-19 01:21 - 2013-11-19 01:21 - 105004989 _____ C:\windows\SysWOW64\ﶙ齛Lř
2013-11-18 21:20 - 2013-11-18 21:20 - 00989176 _____ C:\windows\Minidump\111813-21637-01.dmp
2013-11-18 19:40 - 2013-11-18 19:40 - 00279308 _____ C:\Users\X\Downloads\football-data.co.uk Statistiken Einzelspiele Bundesliga.csv
2013-11-18 19:39 - 2013-11-18 19:39 - 00159127 _____ C:\Users\X\Downloads\05 Methoden I.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00142508 _____ C:\Users\X\Downloads\03 Datenevaluation.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00125010 _____ C:\Users\X\Downloads\02 Datenaufbereitung.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00001015 _____ C:\Users\X\Downloads\04 Weiteres Vorgehen.zip
2013-11-18 18:19 - 2013-11-18 18:19 - 104931504 _____ C:\windows\SysWOW64\ﳿⴴL…
2013-11-17 18:14 - 2013-11-17 23:35 - 00028201 _____ C:\Users\X\Desktop\IKK 23.odt
2013-11-17 17:06 - 2013-11-17 17:24 - 00024519 _____ C:\Users\X\Desktop\Addition.txt
2013-11-17 17:06 - 2013-11-17 17:20 - 00052967 _____ C:\Users\X\Desktop\FRST.txt
2013-11-17 17:03 - 2013-11-17 17:05 - 00024529 _____ C:\Users\X\Downloads\Addition.txt
2013-11-17 17:01 - 2013-11-19 22:07 - 00018652 _____ C:\Users\X\Downloads\FRST.txt
2013-11-17 17:01 - 2013-11-17 17:01 - 00000000 ____D C:\FRST
2013-11-17 16:47 - 2013-11-17 16:47 - 01958026 _____ (Farbar) C:\Users\X\Downloads\FRST64.exe
2013-11-17 14:14 - 2013-11-17 14:15 - 00916240 _____ C:\windows\Minidump\111713-32682-01.dmp
2013-11-17 14:14 - 2013-11-17 14:14 - 00444464 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 13:35 - 2013-11-17 13:35 - 104641146 _____ C:\windows\SysWOW64\᯾瞉ℐ™߿
2013-11-17 12:50 - 2013-11-17 12:55 - 00017018 _____ C:\Users\X\Desktop\Anschreiben.odt
2013-11-16 22:39 - 2013-11-16 22:39 - 104637397 _____ C:\windows\SysWOW64\촫ꟼLĬ
2013-11-16 13:49 - 2013-11-18 23:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 01:51 - 2013-11-16 01:51 - 104513208 _____ C:\windows\SysWOW64\΅魱L¡
2013-11-15 17:51 - 2013-11-05 23:58 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-15 17:51 - 2013-11-05 23:58 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 04:01 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-15 04:01 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-15 04:01 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll
2013-11-15 04:01 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d11.dll
2013-11-15 01:47 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys
2013-11-15 01:47 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-15 01:47 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
2013-11-15 01:47 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-15 01:47 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-15 01:47 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-15 01:47 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-15 01:47 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-15 01:47 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-15 01:47 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2013-11-15 01:47 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2013-11-15 01:47 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2013-11-15 01:47 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2013-11-15 01:47 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2013-11-15 01:47 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2013-11-15 01:47 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-15 01:47 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\crashdmp.sys
2013-11-15 01:47 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\windows\system32\UIAutomationCore.dll
2013-11-15 01:47 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\windows\SysWOW64\UIAutomationCore.dll
2013-11-15 01:47 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys
2013-11-15 01:47 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tpm.sys
2013-11-15 01:47 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2013-11-15 01:47 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2013-11-15 01:47 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2013-11-15 01:47 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2013-11-15 01:47 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll
2013-11-15 01:47 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-15 01:46 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-15 01:46 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-15 01:46 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-15 01:46 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-15 01:46 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-15 01:46 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-14 22:09 - 2013-11-14 22:09 - 104278918 _____ C:\windows\SysWOW64\㿔ߏLû
2013-11-14 14:47 - 2013-11-14 14:47 - 00000000 ____D C:\Users\Administrator\Desktop\RStudio
2013-11-14 14:46 - 2013-11-14 14:47 - 00000000 ____D C:\Users\X\Desktop\RStudio
2013-11-14 14:33 - 2013-11-14 14:33 - 00000000 ____D C:\Program Files\RStudio
2013-11-14 14:30 - 2013-11-14 14:31 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551(1).exe
2013-11-14 14:28 - 2013-11-14 14:28 - 00001043 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001035 _____ C:\Users\Public\Desktop\R i386 3.0.2.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001028 _____ C:\Users\Public\Desktop\R x64 3.0.2.lnk
2013-11-14 14:24 - 2013-11-14 14:24 - 00000000 ____D C:\Program Files\R
2013-11-14 14:23 - 2013-11-14 14:24 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win(1).exe
2013-11-14 14:11 - 2013-11-14 14:12 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win.exe
2013-11-14 14:06 - 2013-11-14 14:07 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551.exe
2013-11-14 10:58 - 2013-11-14 10:58 - 104200551 _____ C:\windows\SysWOW64\㔴훂Lř
2013-11-14 00:43 - 2013-11-14 00:43 - 104165720 _____ C:\windows\SysWOW64\᯾盵竀Å߿
2013-11-13 21:40 - 2013-11-13 21:40 - 00065560 _____ C:\Users\X\Downloads\NETGEAR_DG834Gv5.cfg
2013-11-13 16:42 - 2013-11-13 16:42 - 104010312 _____ C:\windows\SysWOW64\᯾睾몀Ê߿
2013-11-13 14:24 - 2013-11-13 14:24 - 104010312 _____ C:\windows\SysWOW64\᯾眠뢐9߿
2013-11-13 00:40 - 2013-11-13 00:40 - 103988193 _____ C:\windows\SysWOW64\᯾直窐Á߿
2013-11-13 00:38 - 2013-11-13 00:38 - 00281232 _____ C:\windows\Minidump\111313-22292-01.dmp
2013-11-12 20:38 - 2013-11-12 20:38 - 103974937 _____ C:\windows\SysWOW64\᯾眘撈İ߿
2013-11-11 23:56 - 2013-11-12 01:56 - 103792856 _____ C:\windows\SysWOW64\᯾瞱䏰ĵ߿
2013-11-11 22:04 - 2013-11-11 22:18 - 00040960 _____ C:\Users\X\Desktop\HRM_Mitarbeiterbefragung 2.xls
2013-11-11 21:56 - 2013-11-11 21:56 - 103792856 _____ C:\windows\SysWOW64\冿㋆Lʼn
2013-11-11 21:48 - 2013-11-11 21:48 - 00061989 _____ C:\Users\X\Downloads\HRM_Mitarbeiterbefragung.xlsx
2013-11-11 17:54 - 2013-11-11 17:54 - 103792856 _____ C:\windows\SysWOW64\㷃欒Læ
2013-11-11 09:08 - 2013-11-11 09:08 - 103681534 _____ C:\windows\SysWOW64\᯾盽表å߿
2013-11-10 21:25 - 2013-11-10 21:25 - 00021917 _____ C:\Users\X\Desktop\Kultur 2.odt
2013-11-10 17:02 - 2013-11-10 17:02 - 00387264 _____ C:\windows\Minidump\111013-22370-01.dmp
2013-11-10 15:09 - 2013-11-10 15:09 - 103467942 _____ C:\windows\SysWOW64\︝L£
2013-11-10 01:13 - 2013-11-10 01:13 - 103387443 _____ C:\windows\SysWOW64\᯾瞒俨Į߿
2013-11-09 23:11 - 2013-11-09 23:12 - 00961304 _____ C:\windows\Minidump\110913-21512-01.dmp
2013-11-08 22:49 - 2013-11-08 22:49 - 103316092 _____ C:\windows\SysWOW64\᯾眭ꡀĒ߿
2013-11-08 14:25 - 2013-11-08 14:25 - 103148646 _____ C:\windows\SysWOW64\楧гLŲ
2013-11-07 16:59 - 2013-11-07 21:18 - 103000967 _____ C:\windows\SysWOW64\᯾瞔睸Ù߿
2013-11-06 16:17 - 2013-11-06 16:17 - 102781840 _____ C:\windows\SysWOW64\᯾盺⧈Đ߿
2013-11-06 12:01 - 2013-11-06 14:01 - 102722523 _____ C:\windows\SysWOW64\ꔌ뛚LŘ
2013-11-06 00:34 - 2013-11-06 00:34 - 105119039 _____ C:\windows\SysWOW64\옝㫃Lä
2013-11-05 19:03 - 2013-11-05 19:03 - 00003395 _____ C:\Users\X\Downloads\Online-Tests.zip
2013-11-05 17:20 - 2013-11-05 17:20 - 00985912 _____ C:\windows\Minidump\110513-21184-01.dmp
2013-11-05 13:33 - 2013-11-05 13:33 - 105043933 _____ C:\windows\SysWOW64\᯾眛珈ô߿
2013-11-04 23:39 - 2013-11-04 23:39 - 105007987 _____ C:\windows\SysWOW64\᯾睧儐Ú߿
2013-11-04 19:00 - 2013-11-04 19:00 - 00000299 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk
2013-11-04 18:47 - 2013-11-04 18:57 - 00000000 ____D C:\Users\X\Documents\ALT
2013-11-04 13:04 - 2013-11-04 13:04 - 00989328 _____ C:\windows\Minidump\110413-21200-01.dmp
2013-11-04 11:52 - 2013-11-04 11:52 - 104867914 _____ C:\windows\SysWOW64\걓ᄤLž
2013-11-03 20:52 - 2013-11-03 20:52 - 104814100 _____ C:\windows\SysWOW64\㡩❏Lœ
2013-11-03 18:03 - 2013-11-03 18:03 - 00000000 ____D C:\Users\X\Documents\R
2013-11-03 14:17 - 2013-11-03 14:17 - 104760586 _____ C:\windows\SysWOW64\쬅䥚LƆ
2013-11-02 19:34 - 2013-11-02 19:34 - 104684788 _____ C:\windows\SysWOW64\᯾眤둀ę߿
2013-11-02 15:28 - 2013-11-02 17:35 - 104684788 _____ C:\windows\SysWOW64\ꡤ甊LƋ
2013-11-01 20:48 - 2013-11-01 20:48 - 104569497 _____ C:\windows\SysWOW64\᯾盹∀]߿
2013-11-01 03:22 - 2013-11-01 03:22 - 00027032 _____ (TOSHIBA Corporation) C:\windows\system32\Drivers\tosrfec.sys
2013-10-31 23:36 - 2013-10-31 23:36 - 104470377 _____ C:\windows\SysWOW64\�LÆ
2013-10-31 20:06 - 2013-10-31 20:07 - 00983200 _____ C:\windows\Minidump\103113-20950-01.dmp
2013-10-31 15:34 - 2013-10-31 15:34 - 00034707 _____ C:\Users\X\Documents\.RData
2013-10-31 14:45 - 2013-10-31 14:45 - 104348737 _____ C:\windows\SysWOW64\冿燝LŌ
2013-10-31 14:35 - 2013-10-31 15:40 - 00000000 ____D C:\wsp
2013-10-31 14:21 - 2013-10-31 14:21 - 00021827 _____ C:\wsp.zip
2013-10-30 20:27 - 2013-10-30 20:27 - 104193179 _____ C:\windows\SysWOW64\᯾眘聐Ī߿
2013-10-29 10:04 - 2013-10-29 10:04 - 103932228 _____ C:\windows\SysWOW64\֏澎LŇ
2013-10-28 13:00 - 2013-10-28 13:00 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung(1).ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 03063296 _____ C:\Users\X\Downloads\Innovation im Tourismus.ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung.ppt
2013-10-28 11:51 - 2013-10-28 11:51 - 00084990 _____ C:\Users\X\Downloads\D1 (2).csv
2013-10-28 11:46 - 2013-10-28 11:46 - 00085517 _____ C:\Users\X\Downloads\D1 (1).csv
2013-10-28 11:41 - 2013-10-28 11:41 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964 (1).xls
2013-10-28 11:40 - 2013-10-28 11:40 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964.xls
2013-10-28 11:36 - 2013-10-28 11:36 - 00000000 ____D C:\ProgramData\Oracle
2013-10-28 11:33 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-28 11:33 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-10-28 11:33 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-10-28 11:33 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-10-28 11:32 - 2013-10-28 11:33 - 00004886 _____ C:\windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-28 11:24 - 2013-10-28 11:24 - 00040448 _____ C:\Users\X\Downloads\236258_teams-of-the-german-bundesliga-by-brand-value.xls
2013-10-28 10:58 - 2013-10-28 11:21 - 00000000 ____D C:\FPM
2013-10-28 10:52 - 2013-10-28 10:52 - 00022841 _____ C:\Users\X\Downloads\D1.csv
2013-10-28 10:48 - 2013-10-28 10:48 - 01910272 _____ C:\Users\X\Downloads\soccer---statista-dossier-2013.ppt
2013-10-28 02:40 - 2013-10-28 02:40 - 103622390 _____ C:\windows\SysWOW64\�けLÊ
2013-10-27 11:43 - 2013-10-27 11:44 - 30694824 _____ (Oracle Corporation) C:\Users\X\Downloads\jre-7u45-windows-x64.exe
2013-10-25 13:45 - 2013-10-25 13:45 - 102975063 _____ C:\windows\SysWOW64\㲇熏Ls
2013-10-25 00:51 - 2013-10-30 21:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-24 19:44 - 2013-10-24 19:44 - 102837954 _____ C:\windows\SysWOW64\䢀L×
2013-10-24 11:42 - 2013-10-24 11:42 - 102787172 _____ C:\windows\SysWOW64\᯾睆璸ē߿
2013-10-24 09:00 - 2013-10-24 09:00 - 102758948 _____ C:\windows\SysWOW64\᯾矨濰Ģ߿
2013-10-23 09:46 - 2013-10-23 09:46 - 102541796 _____ C:\windows\SysWOW64\᯾瞳蕀Ĩ߿
2013-10-23 00:14 - 2013-10-23 00:14 - 00000000 ____D C:\Users\X\AppData\Roaming\RStudio
2013-10-23 00:03 - 2013-10-23 00:05 - 54079987 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-Installer 3.0.1.exe
2013-10-23 00:03 - 2013-10-23 00:03 - 34085760 _____ C:\Users\X\Downloads\R-Studio Installer 0.97.551.exe
2013-10-22 15:01 - 2013-10-22 15:01 - 102329055 _____ C:\windows\SysWOW64\᪣瓻Lĩ
2013-10-20 18:34 - 2013-10-20 18:34 - 102068998 _____ C:\windows\SysWOW64\ာꖭL¢
2013-10-20 14:35 - 2013-10-20 14:35 - 00978624 _____ C:\windows\Minidump\102013-24304-01.dmp
2013-10-20 13:27 - 2013-10-20 13:27 - 102034533 _____ C:\windows\SysWOW64\ﭵLĊ

==================== One Month Modified Files and Folders =======

2013-11-19 22:08 - 2013-11-17 17:01 - 00018652 _____ C:\Users\X\Downloads\FRST.txt
2013-11-19 22:06 - 2013-11-19 22:06 - 01957964 _____ (Farbar) C:\Users\X\Downloads\FRST64(1).exe
2013-11-19 22:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2013-11-19 21:55 - 2013-11-19 21:55 - 00001019 _____ C:\Users\X\Desktop\JRT.txt
2013-11-19 21:53 - 2013-03-01 20:23 - 00003596 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3327028523-651003497-3907724089-1001
2013-11-19 21:52 - 2013-03-05 14:12 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-19 21:45 - 2013-11-19 21:45 - 00000000 ____D C:\windows\ERUNT
2013-11-19 21:43 - 2013-11-19 21:43 - 01034531 _____ (Thisisu) C:\Users\X\Downloads\JRT.exe
2013-11-19 21:39 - 2013-11-19 21:18 - 00000000 ____D C:\AdwCleaner
2013-11-19 21:39 - 2013-07-22 18:43 - 00000000 ____D C:\Users\X\AppData\Roaming\Dropbox
2013-11-19 21:39 - 2013-07-08 00:24 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-19 21:38 - 2013-07-22 18:47 - 00000000 ___RD C:\Users\X\Dropbox
2013-11-19 21:38 - 2013-05-01 18:59 - 00049698 _____ C:\ProgramData\lxecscan.log
2013-11-19 21:38 - 2013-03-02 00:19 - 00000000 ____D C:\Users\X\AppData\Roaming\Skype
2013-11-19 21:37 - 2013-07-08 00:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-19 21:23 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-19 21:22 - 2012-07-26 06:26 - 01048576 ___SH C:\windows\system32\config\BBI
2013-11-19 21:17 - 2013-11-19 21:17 - 01085542 _____ C:\Users\X\Downloads\adwcleaner.exe
2013-11-19 20:57 - 2013-11-19 20:57 - 00001120 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-19 20:57 - 2013-03-15 16:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-19 20:56 - 2013-11-19 20:56 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\X\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-19 05:58 - 2013-11-19 05:58 - 00006496 _____ C:\Users\X\AppData\Local\recently-used.xbel
2013-11-19 05:56 - 2013-03-07 21:03 - 00000000 ____D C:\Users\X\.gimp-2.8
2013-11-19 03:48 - 2013-03-01 18:15 - 01434093 _____ C:\windows\WindowsUpdate.log
2013-11-19 01:21 - 2013-11-19 01:21 - 105004989 _____ C:\windows\SysWOW64\ﶙ齛Lř
2013-11-18 23:28 - 2013-11-16 13:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-18 23:28 - 2013-04-12 19:55 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-18 21:20 - 2013-11-18 21:20 - 00989176 _____ C:\windows\Minidump\111813-21637-01.dmp
2013-11-18 21:20 - 2013-05-21 00:53 - 1133369737 _____ C:\windows\MEMORY.DMP
2013-11-18 21:20 - 2013-04-09 19:26 - 00000000 ____D C:\windows\Minidump
2013-11-18 19:40 - 2013-11-18 19:40 - 00279308 _____ C:\Users\X\Downloads\football-data.co.uk Statistiken Einzelspiele Bundesliga.csv
2013-11-18 19:39 - 2013-11-18 19:39 - 00159127 _____ C:\Users\X\Downloads\05 Methoden I.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00142508 _____ C:\Users\X\Downloads\03 Datenevaluation.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00125010 _____ C:\Users\X\Downloads\02 Datenaufbereitung.zip
2013-11-18 19:39 - 2013-11-18 19:39 - 00001015 _____ C:\Users\X\Downloads\04 Weiteres Vorgehen.zip
2013-11-18 18:19 - 2013-11-18 18:19 - 104931504 _____ C:\windows\SysWOW64\ﳿⴴL…
2013-11-17 23:35 - 2013-11-17 18:14 - 00028201 _____ C:\Users\X\Desktop\IKK 23.odt
2013-11-17 17:24 - 2013-11-17 17:06 - 00024519 _____ C:\Users\X\Desktop\Addition.txt
2013-11-17 17:20 - 2013-11-17 17:06 - 00052967 _____ C:\Users\X\Desktop\FRST.txt
2013-11-17 17:05 - 2013-11-17 17:03 - 00024529 _____ C:\Users\X\Downloads\Addition.txt
2013-11-17 17:01 - 2013-11-17 17:01 - 00000000 ____D C:\FRST
2013-11-17 16:47 - 2013-11-17 16:47 - 01958026 _____ (Farbar) C:\Users\X\Downloads\FRST64.exe
2013-11-17 14:15 - 2013-11-17 14:14 - 00916240 _____ C:\windows\Minidump\111713-32682-01.dmp
2013-11-17 14:14 - 2013-11-17 14:14 - 00444464 _____ C:\windows\system32\FNTCACHE.DAT
2013-11-17 13:35 - 2013-11-17 13:35 - 104641146 _____ C:\windows\SysWOW64\᯾瞉ℐ™߿
2013-11-17 12:55 - 2013-11-17 12:50 - 00017018 _____ C:\Users\X\Desktop\Anschreiben.odt
2013-11-17 11:41 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat
2013-11-17 11:41 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat
2013-11-17 11:41 - 2012-07-26 08:28 - 01745416 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-17 11:35 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData
2013-11-17 11:35 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore
2013-11-17 04:08 - 2013-03-01 20:24 - 00000000 ____D C:\Users\X\AppData\Local\DoNotTrackPlus
2013-11-16 22:39 - 2013-11-16 22:39 - 104637397 _____ C:\windows\SysWOW64\촫ꟼLĬ
2013-11-16 14:41 - 2013-03-05 00:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-16 13:23 - 2013-08-16 10:54 - 00000000 ____D C:\windows\system32\MRT
2013-11-16 13:20 - 2013-03-02 21:44 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-11-16 01:51 - 2013-11-16 01:51 - 104513208 _____ C:\windows\SysWOW64\΅魱L¡
2013-11-15 19:27 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-11-15 04:06 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-11-15 02:27 - 2012-07-26 06:26 - 00000199 _____ C:\windows\win.ini
2013-11-14 22:09 - 2013-11-14 22:09 - 104278918 _____ C:\windows\SysWOW64\㿔ߏLû
2013-11-14 14:47 - 2013-11-14 14:47 - 00000000 ____D C:\Users\Administrator\Desktop\RStudio
2013-11-14 14:47 - 2013-11-14 14:46 - 00000000 ____D C:\Users\X\Desktop\RStudio
2013-11-14 14:33 - 2013-11-14 14:33 - 00000000 ____D C:\Program Files\RStudio
2013-11-14 14:31 - 2013-11-14 14:30 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551(1).exe
2013-11-14 14:28 - 2013-11-14 14:28 - 00001043 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001035 _____ C:\Users\Public\Desktop\R i386 3.0.2.lnk
2013-11-14 14:25 - 2013-11-14 14:25 - 00001028 _____ C:\Users\Public\Desktop\R x64 3.0.2.lnk
2013-11-14 14:24 - 2013-11-14 14:24 - 00000000 ____D C:\Program Files\R
2013-11-14 14:24 - 2013-11-14 14:23 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win(1).exe
2013-11-14 14:12 - 2013-11-14 14:11 - 53957312 _____ (R Core Team                                                 ) C:\Users\X\Downloads\R-3.0.2-win.exe
2013-11-14 14:07 - 2013-11-14 14:06 - 34085760 _____ C:\Users\X\Downloads\RStudio-0.97.551.exe
2013-11-14 10:58 - 2013-11-14 10:58 - 104200551 _____ C:\windows\SysWOW64\㔴훂Lř
2013-11-14 00:43 - 2013-11-14 00:43 - 104165720 _____ C:\windows\SysWOW64\᯾盵竀Å߿
2013-11-13 22:48 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF
2013-11-13 21:40 - 2013-11-13 21:40 - 00065560 _____ C:\Users\X\Downloads\NETGEAR_DG834Gv5.cfg
2013-11-13 16:42 - 2013-11-13 16:42 - 104010312 _____ C:\windows\SysWOW64\᯾睾몀Ê߿
2013-11-13 14:24 - 2013-11-13 14:24 - 104010312 _____ C:\windows\SysWOW64\᯾眠뢐9߿
2013-11-13 00:40 - 2013-11-13 00:40 - 103988193 _____ C:\windows\SysWOW64\᯾直窐Á߿
2013-11-13 00:38 - 2013-11-13 00:38 - 00281232 _____ C:\windows\Minidump\111313-22292-01.dmp
2013-11-12 20:38 - 2013-11-12 20:38 - 103974937 _____ C:\windows\SysWOW64\᯾眘撈İ߿
2013-11-12 01:56 - 2013-11-11 23:56 - 103792856 _____ C:\windows\SysWOW64\᯾瞱䏰ĵ߿
2013-11-12 00:48 - 2013-02-19 00:07 - 00000000 ____D C:\Users\X\AppData\Local\Packages
2013-11-11 22:18 - 2013-11-11 22:04 - 00040960 _____ C:\Users\X\Desktop\HRM_Mitarbeiterbefragung 2.xls
2013-11-11 21:56 - 2013-11-11 21:56 - 103792856 _____ C:\windows\SysWOW64\冿㋆Lʼn
2013-11-11 21:48 - 2013-11-11 21:48 - 00061989 _____ C:\Users\X\Downloads\HRM_Mitarbeiterbefragung.xlsx
2013-11-11 17:54 - 2013-11-11 17:54 - 103792856 _____ C:\windows\SysWOW64\㷃欒Læ
2013-11-11 09:08 - 2013-11-11 09:08 - 103681534 _____ C:\windows\SysWOW64\᯾盽表å߿
2013-11-10 21:25 - 2013-11-10 21:25 - 00021917 _____ C:\Users\X\Desktop\Kultur 2.odt
2013-11-10 17:02 - 2013-11-10 17:02 - 00387264 _____ C:\windows\Minidump\111013-22370-01.dmp
2013-11-10 15:09 - 2013-11-10 15:09 - 103467942 _____ C:\windows\SysWOW64\︝L£
2013-11-10 01:13 - 2013-11-10 01:13 - 103387443 _____ C:\windows\SysWOW64\᯾瞒俨Į߿
2013-11-09 23:12 - 2013-11-09 23:11 - 00961304 _____ C:\windows\Minidump\110913-21512-01.dmp
2013-11-08 22:49 - 2013-11-08 22:49 - 103316092 _____ C:\windows\SysWOW64\᯾眭ꡀĒ߿
2013-11-08 14:25 - 2013-11-08 14:25 - 103148646 _____ C:\windows\SysWOW64\楧гLŲ
2013-11-08 11:30 - 2012-08-19 02:45 - 00025792 _____ C:\windows\PFRO.log
2013-11-07 21:18 - 2013-11-07 16:59 - 103000967 _____ C:\windows\SysWOW64\᯾瞔睸Ù߿
2013-11-06 16:17 - 2013-11-06 16:17 - 102781840 _____ C:\windows\SysWOW64\᯾盺⧈Đ߿
2013-11-06 14:01 - 2013-11-06 12:01 - 102722523 _____ C:\windows\SysWOW64\ꔌ뛚LŘ
2013-11-06 13:37 - 2013-03-02 00:18 - 00000000 ____D C:\ProgramData\Skype
2013-11-06 13:36 - 2013-03-02 00:18 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-06 00:34 - 2013-11-06 00:34 - 105119039 _____ C:\windows\SysWOW64\옝㫃Lä
2013-11-05 23:58 - 2013-11-15 17:51 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-11-05 23:58 - 2013-11-15 17:51 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-05 19:03 - 2013-11-05 19:03 - 00003395 _____ C:\Users\X\Downloads\Online-Tests.zip
2013-11-05 17:20 - 2013-11-05 17:20 - 00985912 _____ C:\windows\Minidump\110513-21184-01.dmp
2013-11-05 13:33 - 2013-11-05 13:33 - 105043933 _____ C:\windows\SysWOW64\᯾眛珈ô߿
2013-11-05 13:09 - 2013-03-01 18:15 - 00000000 ____D C:\Users\X
2013-11-04 23:39 - 2013-11-04 23:39 - 105007987 _____ C:\windows\SysWOW64\᯾睧儐Ú߿
2013-11-04 19:00 - 2013-11-04 19:00 - 00000299 _____ C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk
2013-11-04 18:57 - 2013-11-04 18:47 - 00000000 ____D C:\Users\X\Documents\ALT
2013-11-04 18:57 - 2013-03-03 01:04 - 00000000 ____D C:\Users\X\Documents\Dokumente
2013-11-04 13:04 - 2013-11-04 13:04 - 00989328 _____ C:\windows\Minidump\110413-21200-01.dmp
2013-11-04 11:59 - 2012-07-26 08:21 - 00038658 _____ C:\windows\setupact.log
2013-11-04 11:52 - 2013-11-04 11:52 - 104867914 _____ C:\windows\SysWOW64\걓ᄤLž
2013-11-03 20:52 - 2013-11-03 20:52 - 104814100 _____ C:\windows\SysWOW64\㡩❏Lœ
2013-11-03 18:03 - 2013-11-03 18:03 - 00000000 ____D C:\Users\X\Documents\R
2013-11-03 14:17 - 2013-11-03 14:17 - 104760586 _____ C:\windows\SysWOW64\쬅䥚LƆ
2013-11-02 21:01 - 2013-07-22 18:46 - 00000000 ____D C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-02 21:01 - 2013-03-01 18:21 - 00000000 ___RD C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-02 19:34 - 2013-11-02 19:34 - 104684788 _____ C:\windows\SysWOW64\᯾眤둀ę߿
2013-11-02 17:35 - 2013-11-02 15:28 - 104684788 _____ C:\windows\SysWOW64\ꡤ甊LƋ
2013-11-01 20:48 - 2013-11-01 20:48 - 104569497 _____ C:\windows\SysWOW64\᯾盹∀]߿
2013-11-01 03:22 - 2013-11-01 03:22 - 00027032 _____ (TOSHIBA Corporation) C:\windows\system32\Drivers\tosrfec.sys
2013-10-31 23:36 - 2013-10-31 23:36 - 104470377 _____ C:\windows\SysWOW64\�LÆ
2013-10-31 20:07 - 2013-10-31 20:06 - 00983200 _____ C:\windows\Minidump\103113-20950-01.dmp
2013-10-31 15:40 - 2013-10-31 14:35 - 00000000 ____D C:\wsp
2013-10-31 15:34 - 2013-10-31 15:34 - 00034707 _____ C:\Users\X\Documents\.RData
2013-10-31 14:45 - 2013-10-31 14:45 - 104348737 _____ C:\windows\SysWOW64\冿燝LŌ
2013-10-31 14:21 - 2013-10-31 14:21 - 00021827 _____ C:\wsp.zip
2013-10-30 21:20 - 2013-10-25 00:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 20:27 - 2013-10-30 20:27 - 104193179 _____ C:\windows\SysWOW64\᯾眘聐Ī߿
2013-10-29 10:04 - 2013-10-29 10:04 - 103932228 _____ C:\windows\SysWOW64\֏澎LŇ
2013-10-28 13:00 - 2013-10-28 13:00 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung(1).ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 03063296 _____ C:\Users\X\Downloads\Innovation im Tourismus.ppt
2013-10-28 12:58 - 2013-10-28 12:58 - 01570816 _____ C:\Users\X\Downloads\Tourismusmanagement_Einfuhrung.ppt
2013-10-28 11:51 - 2013-10-28 11:51 - 00084990 _____ C:\Users\X\Downloads\D1 (2).csv
2013-10-28 11:46 - 2013-10-28 11:46 - 00085517 _____ C:\Users\X\Downloads\D1 (1).csv
2013-10-28 11:41 - 2013-10-28 11:41 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964 (1).xls
2013-10-28 11:40 - 2013-10-28 11:40 - 00033792 _____ C:\Users\X\Downloads\5987_zuschauerzahlen-in-der-bundesliga-seit-1964.xls
2013-10-28 11:36 - 2013-10-28 11:36 - 00000000 ____D C:\ProgramData\Oracle
2013-10-28 11:33 - 2013-10-28 11:32 - 00004886 _____ C:\windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-28 11:33 - 2013-03-17 01:12 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-28 11:24 - 2013-10-28 11:24 - 00040448 _____ C:\Users\X\Downloads\236258_teams-of-the-german-bundesliga-by-brand-value.xls
2013-10-28 11:21 - 2013-10-28 10:58 - 00000000 ____D C:\FPM
2013-10-28 10:52 - 2013-10-28 10:52 - 00022841 _____ C:\Users\X\Downloads\D1.csv
2013-10-28 10:48 - 2013-10-28 10:48 - 01910272 _____ C:\Users\X\Downloads\soccer---statista-dossier-2013.ppt
2013-10-28 02:40 - 2013-10-28 02:40 - 103622390 _____ C:\windows\SysWOW64\�けLÊ
2013-10-27 11:44 - 2013-10-27 11:43 - 30694824 _____ (Oracle Corporation) C:\Users\X\Downloads\jre-7u45-windows-x64.exe
2013-10-25 13:45 - 2013-10-25 13:45 - 102975063 _____ C:\windows\SysWOW64\㲇熏Ls
2013-10-24 19:44 - 2013-10-24 19:44 - 102837954 _____ C:\windows\SysWOW64\䢀L×
2013-10-24 11:42 - 2013-10-24 11:42 - 102787172 _____ C:\windows\SysWOW64\᯾睆璸ē߿
2013-10-24 09:00 - 2013-10-24 09:00 - 102758948 _____ C:\windows\SysWOW64\᯾矨濰Ģ߿
2013-10-23 17:11 - 2013-05-01 19:10 - 00006740 _____ C:\ProgramData\lxecJSW.log
2013-10-23 17:11 - 2013-05-01 19:02 - 00000000 ____D C:\ProgramData\Lx_cats
2013-10-23 09:46 - 2013-10-23 09:46 - 102541796 _____ C:\windows\SysWOW64\᯾瞳蕀Ĩ߿
2013-10-23 00:14 - 2013-10-23 00:14 - 00000000 ____D C:\Users\X\AppData\Roaming\RStudio
2013-10-23 00:05 - 2013-10-23 00:03 - 54079987 _____ (R Core Team                                                 ) C:\Users\Renate\Downloads\R-Installer 3.0.1.exe
2013-10-23 00:03 - 2013-10-23 00:03 - 34085760 _____ C:\Users\X\Downloads\R-Studio Installer 0.97.551.exe
2013-10-22 15:01 - 2013-10-22 15:01 - 102329055 _____ C:\windows\SysWOW64\᪣瓻Lĩ
2013-10-20 18:34 - 2013-10-20 18:34 - 102068998 _____ C:\windows\SysWOW64\ာꖭL¢
2013-10-20 14:35 - 2013-10-20 14:35 - 00978624 _____ C:\windows\Minidump\102013-24304-01.dmp
2013-10-20 13:27 - 2013-10-20 13:27 - 102034533 _____ C:\windows\SysWOW64\ﭵLĊ

Some content of TEMP:
====================
C:\Users\X\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\X\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\X\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\XAppData\Local\Temp\NEW98EE.tmp.exe
C:\Users\X\AppData\Local\Temp\ose00000.exe
C:\Users\X\AppData\Local\Temp\Quarantine.exe
C:\Users\X\AppData\Local\Temp\setup.exe
C:\Users\X\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-18 03:40

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Addition gab es nicht??

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?