Win7: TR/wysotet.Gen - eSafe\eGdpSvc.exe fund. Wie kann ich löschen?

Exportierte Ereignisse:

22.11.2013 12:03 [System-Scanner] Malware gefunden
      Die Datei 'D:\STEWO\Backup Set 2013-08-11 232923\Backup Files 2013-08-11 
      232923\Backup files 1.zip'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Eine Sicherungskopie wurde unter dem Namen 7817f380.qua erstellt ( QUARANTÄNE ).
      Die Datei wurde gelöscht.

22.11.2013 12:02 [System-Scanner] Malware gefunden
      Die Datei 'D:\STEWO\Backup Set 2013-07-01 005340\Backup Files 2013-07-23 
      214516\Backup files 1.zip'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Eine Sicherungskopie wurde unter dem Namen 1e20bc24.qua erstellt ( QUARANTÄNE ).
      Die Datei wurde gelöscht.

22.11.2013 11:43 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Stefan 
      Wolff\AppData\Roaming\eIntaller\4E8BED311CB749b1B3648EA8FB56E617\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Eine Sicherungskopie wurde unter dem Namen 4c7e9b04.qua erstellt ( QUARANTÄNE ).
      Die Datei wurde gelöscht.

22.11.2013 11:42 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Stefan 
      Wolff\AppData\Local\Temp\is1275519350\cor_ar_201374152420_qvo6.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Eine Sicherungskopie wurde unter dem Namen 551bb4af.qua erstellt ( QUARANTÄNE ).
      Die Datei wurde gelöscht.

22.11.2013 11:00 [System-Scanner] Malware gefunden
      Die Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde gelöscht.

22.11.2013 10:59 [System-Scanner] Malware gefunden
      Die Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Eine Sicherungskopie wurde unter dem Namen 5ad8bc88.qua erstellt ( QUARANTÄNE ).
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!

22.11.2013 10:56 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

22.11.2013 10:55 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

22.11.2013 10:55 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

22.11.2013 10:04 [System-Scanner] Malware gefunden
      Die Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan].
      Durchgeführte Aktion(en):
      Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler 
      aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
      Die Datei konnte nicht gelöscht werden!
      Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
      Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
      Die Datei konnte nicht gelöscht werden!
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.
      Der Registrierungseintrag 
      <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WsysSvc\ImagePath> wurde 
      erfolgreich repariert.

22.11.2013 09:55 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

22.11.2013 03:25 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

22.11.2013 03:25 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\ProgramData\eSafe\eGdpSvc.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Wysotot.Gen' [trojan] gefunden.
      Ausgeführte Aktion: Zugriff verweigern
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:39 on 22/11/2013 (Stefan W)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by Stefan W (administrator) on STEWO on 22-11-2013 13:50:42
Running from D:\kack teil
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\ATService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(O2Micro International) C:\Windows\system32\DRIVERS\o2flash.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TOSHIBA Corporation) C:\Windows\system32\ThpSrv.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(TOSHIBA Corporation.) C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
(TOSHIBA) C:\Program Files\Toshiba\TFPU\TFPUPWDBank.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
() C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(TOSHIBA Corporation.) C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(1&1 Mail & Media GmbH) C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Abine Inc.) C:\Program Files (x86)\Ask.com\AbineSDK\IE\DNTPService.exe
(CallingID Ltd.) C:\Program Files (x86)\Ask.com\CallingIDSDK\CIDGlobalLight.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\Toshiba\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [910136 2009-11-10] (TOSHIBA Corporation)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-07-16] ()
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe [508472 2009-10-09] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1810728 2009-07-30] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] - C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1489760 2010-04-06] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [HDMICtrlMan] - C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe [1032536 2009-10-23] (TOSHIBA Corporation.)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [707416 2009-11-10] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] - C:\Program Files\Toshiba\TFPU\TFPUPWDBank.exe [925104 2009-11-06] (TOSHIBA)
HKLM\...\Run: [TFPUService] - C:\Program Files\Toshiba\TFPU\TFPUTaskMonitor.exe [793008 2009-11-06] (TOSHIBA)
HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-11-30] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe [34648 2009-12-01] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [134032 2009-08-25] (Toshiba Europe GmbH)
HKCU\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\TOPI.exe [6203296 2009-08-12] 

(TOSHIBA)
HKCU\...\Run: [Steam] - F:\Steam\Steam.exe [958464 2003-09-11] (Valve Corporation)
HKCU\...\Run: [Comrade.exe] - C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [36864 2007-06-29] (IGN Entertainment Inc.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
MountPoints2: {faac01cb-13d3-11df-b728-806e6f6e6963} - E:\Installer.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TUSBSleepChargeSrv] - C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe [253312 2009-10-26] 

(TOSHIBA)
HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294136 2009-10-06] 

(TOSHIBA Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2009-11-24] (TOSHIBA 

CORPORATION.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-19] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-07] (Avira Operations GmbH & Co. KG)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\TOPI.exe [6203296 2009-08

-12] (TOSHIBA)
HKU\Diablo II - Loader\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\TOPI.exe 

[6203296 2009-08-12] (TOSHIBA)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKCU - {2248AA46-0A8D-49F6-B4B1-248E74A510A3} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?

utm_source=b&utm_medium=cor&from=cor&uid=TOSHIBAXMK3263GSX_10IGCF7FTXX10IGCF7FT&ts=1374188540
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKCU - {8FFDF073-1A50-49F5-B128-107A97C2B067} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q=

{searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^VL^DE&apn_uid=189ab65a-a5f5-41e9-9775-a2ac2e99fbae&apn_sauid=E677C1EC-DA0E-4994-BFD7-

5EA3768E6457
SearchScopes: HKCU - {944D690C-DFC7-4FA5-AFDA-2D548EB2808A} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {A424A201-C21A-4C74-A395-44FB7C694582} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {ECF9DBC9-8048-42FE-9C6C-06697DCE1DC5} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-

search-21&index=blended&linkCode=ur2
SearchScopes: HKCU - {ED518544-1EF9-4F13-B244-580379B2D72C} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {FF487ABC-D3E0-4F9A-9D91-484EB06F893A} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll 

(Google Inc.)
BHO: GMX Toolbar BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
BHO-x32: TFPUPWDBankBHO Class - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\Toshiba\TFPU\x86\TFPUPWDBankBHO.dll (TODO: <Company name>)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 

(Adobe Systems Incorporated)
BHO-x32: LyricsWoofer - {73F8F433-14C8-48AA-8412-54BC6F8D3FA3} - C:\Program Files (x86)\LyricsWoofer\116.dll No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows 

Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google 

Inc.)
BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer

\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier

\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: GMX Toolbar BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component

\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll 

(Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, 

Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google 

Inc.)
Toolbar: HKLM - GMX Toolbar - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google 

Inc.)
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - GMX Toolbar - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com

\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google 

Inc.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - GMX Toolbar - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft 

Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft 

Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll 

(Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 217.0.43.17 217.0.43.49 194.25.2.129

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-07] (Avira Operations GmbH & Co. KG)
R2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [246520 2010-03-28] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2011-09-20] ()
S2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-28] (Avira Operations GmbH & Co. KG)
R3 O2SDGRDR; C:\Windows\System32\DRIVERS\o2sdgx64.sys [49568 2009-08-18] (O2Micro )

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-22 13:50 - 2013-11-22 13:50 - 00000000 ____D C:\FRST
2013-11-22 13:44 - 2013-11-22 13:46 - 00001159 _____ C:\Users\Stefan W\Desktop\Continue Zip Extractor Installation.lnk
2013-11-22 13:39 - 2013-11-22 13:39 - 00000486 _____ C:\Users\Stefan W\Desktop\defogger_disable.log
2013-11-22 13:39 - 2013-11-22 13:39 - 00000000 _____ C:\Users\Stefan W\defogger_reenable
2013-11-22 13:33 - 2013-11-22 13:33 - 00010782 _____ C:\Users\Stefan W\Desktop\Ereignisse.txt
2013-11-22 13:32 - 2013-11-22 13:32 - 00038344 _____ C:\Users\Stefan W\Desktop\AVSCAN-20131122-110743-232ECD10.LOG
2013-11-22 12:55 - 2013-11-22 13:38 - 00000768 _____ C:\Users\Stefan W\Desktop\kackteil.txt
2013-11-22 12:31 - 2013-11-22 12:31 - 00050477 _____ C:\Users\Stefan W\Desktop\Defogger.exe
2013-11-22 10:44 - 2013-11-22 10:45 - 00000958 _____ C:\Users\Stefan W\Desktop\Diablo II - Verknüpfung.lnk
2013-11-22 10:44 - 2013-11-22 10:44 - 00000905 _____ C:\Users\Stefan W\Desktop\Diablo II.lnk
2013-11-21 21:07 - 2013-11-22 10:28 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\mIRC
2013-11-21 21:07 - 2013-11-22 10:19 - 00000000 ____D C:\Program Files (x86)\mIRC
2013-11-15 00:58 - 2013-11-22 10:19 - 00000000 ___RD C:\Sandbox
2013-11-15 00:54 - 2013-11-22 10:28 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-13 14:59 - 2013-11-13 14:59 - 00000033 _____ C:\Users\Stefan W\Desktop\yahoo pw.txt
2013-11-13 10:26 - 2013-11-13 10:26 - 00003416 ____N C:\bootsqm.dat
2013-11-13 10:25 - 2013-11-13 10:25 - 00000000 __SHD C:\found.000
2013-11-08 22:49 - 2013-11-22 00:59 - 00006506 _____ C:\Users\Stefan W\Desktop\Diablo II - Accs + d2jsp.txt
2013-11-06 17:57 - 2013-11-06 17:57 - 00000463 _____ C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2013-11-06 17:14 - 2013-11-22 10:28 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-06 17:06 - 2013-11-06 17:06 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
2013-11-06 16:59 - 2013-11-06 16:59 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Toshiba
2013-11-06 16:49 - 2013-11-06 16:49 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Avira
2013-11-06 16:45 - 2013-11-15 00:02 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Local\DoNotTrackPlus
2013-11-06 16:45 - 2013-11-06 16:45 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\TFPU
2013-11-06 16:44 - 2013-11-06 16:44 - 00096976 _____ C:\Users\Diablo II - Loader\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-06 16:44 - 2013-11-06 16:44 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Intel Corporation
2013-11-06 16:43 - 2013-11-22 13:50 - 00000000 ____D C:\Users\Diablo II - Loader
2013-11-06 16:43 - 2013-11-22 10:28 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-06 16:43 - 2013-11-22 10:28 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-06 16:43 - 2013-11-22 10:28 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative 

Tools
2013-11-06 16:43 - 2013-11-22 10:28 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-06 16:43 - 2013-11-06 16:44 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Local\VirtualStore
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Vorlagen
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Startmenü
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Netzwerkumgebung
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Lokale Einstellungen
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Eigene Dateien
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Druckumgebung
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Documents\Eigene Musik
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Documents\Eigene Bilder
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Local\Verlauf
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Local\Anwendungsdaten
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Anwendungsdaten
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Adobe
2013-11-06 16:43 - 2010-06-14 22:43 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Local\Microsoft Help
2013-11-06 16:43 - 2009-12-13 22:33 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Macromedia
2013-11-06 16:24 - 2013-11-06 16:33 - 00000000 ____D C:\Users\Stefan W\VirtualBox VMs
2013-11-06 16:22 - 2013-11-06 16:33 - 00000000 ____D C:\Users\Stefan W\.VirtualBox
2013-11-05 14:53 - 2013-11-06 14:53 - 102753054 _____ C:\Windows\SysWOW64\???Ž
2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2013-11-01 15:03 - 2013-11-01 15:03 - 00021840 _____ C:\Windows\SysWOW64\SIntfNT.dll
2013-11-01 15:03 - 2013-11-01 15:03 - 00017212 _____ C:\Windows\SysWOW64\SIntf32.dll
2013-11-01 15:03 - 2013-11-01 15:03 - 00012067 _____ C:\Windows\SysWOW64\SIntf16.dll
2013-10-30 13:15 - 2013-10-31 09:24 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-10-30 13:08 - 2013-10-30 13:14 - 00139264 _____ (Blizzard Entertainment) C:\Windows\War3Unin.exe
2013-10-30 13:08 - 2013-10-30 13:14 - 00045065 _____ C:\Windows\War3Unin.dat
2013-10-30 13:08 - 2013-10-30 13:14 - 00002829 _____ C:\Windows\War3Unin.pif
2013-10-30 13:08 - 2013-10-30 13:14 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warcraft III
2013-10-29 08:02 - 2013-10-29 08:02 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\WildTangent
2013-10-23 16:28 - 2013-11-22 10:53 - 00000000 ____D C:\Program Files\McAfee Security Scan

==================== One Month Modified Files and Folders =======

2013-11-22 13:50 - 2013-11-22 13:50 - 00000000 ____D C:\FRST
2013-11-22 13:50 - 2013-11-06 16:43 - 00000000 ____D C:\Users\Diablo II - Loader
2013-11-22 13:47 - 2009-07-14 05:45 - 00016080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-22 13:47 - 2009-07-14 05:45 - 00016080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 13:46 - 2013-11-22 13:44 - 00001159 _____ C:\Users\Stefan W\Desktop\Continue Zip Extractor Installation.lnk
2013-11-22 13:39 - 2013-11-22 13:39 - 00000486 _____ C:\Users\Stefan W\Desktop\defogger_disable.log
2013-11-22 13:39 - 2013-11-22 13:39 - 00000000 _____ C:\Users\Stefan W\defogger_reenable
2013-11-22 13:39 - 2010-06-02 17:58 - 00000000 ____D C:\Users\Stefan W
2013-11-22 13:38 - 2013-11-22 12:55 - 00000768 _____ C:\Users\Stefan W\Desktop\kackteil.txt
2013-11-22 13:33 - 2013-11-22 13:33 - 00010782 _____ C:\Users\Stefan W\Desktop\Ereignisse.txt
2013-11-22 13:32 - 2013-11-22 13:32 - 00038344 _____ C:\Users\Stefan W\Desktop\AVSCAN-20131122-110743-232ECD10.LOG
2013-11-22 12:31 - 2013-11-22 12:31 - 00050477 _____ C:\Users\Stefan W\Desktop\Defogger.exe
2013-11-22 12:08 - 2010-02-07 11:30 - 01172399 _____ C:\Windows\WindowsUpdate.log
2013-11-22 11:46 - 2012-10-25 11:37 - 00000000 ____D C:\Users\Stefan W\AppData\Local\DoNotTrackPlus
2013-11-22 11:07 - 2010-06-04 21:24 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\Skype
2013-11-22 11:02 - 2013-07-19 00:01 - 00000418 _____ C:\Windows\Tasks\LyricsWoofer Update.job
2013-11-22 11:02 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-22 11:02 - 2009-07-14 05:51 - 00112905 _____ C:\Windows\setupact.log
2013-11-22 10:59 - 2013-07-19 00:02 - 00000000 ____D C:\ProgramData\eSafe
2013-11-22 10:53 - 2013-10-23 16:28 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-22 10:53 - 2011-03-13 15:15 - 00001938 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-22 10:46 - 2009-07-14 18:58 - 00664868 _____ C:\Windows\system32\perfh007.dat
2013-11-22 10:46 - 2009-07-14 18:58 - 00135004 _____ C:\Windows\system32\perfc007.dat
2013-11-22 10:46 - 2009-07-14 06:13 - 01527550 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-22 10:45 - 2013-11-22 10:44 - 00000958 _____ C:\Users\Stefan W\Desktop\Diablo II - Verknüpfung.lnk
2013-11-22 10:44 - 2013-11-22 10:44 - 00000905 _____ C:\Users\Stefan W\Desktop\Diablo II.lnk
2013-11-22 10:28 - 2013-11-21 21:07 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\mIRC
2013-11-22 10:28 - 2013-11-15 00:54 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-22 10:28 - 2013-11-06 17:14 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-22 10:28 - 2013-11-06 16:43 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-22 10:28 - 2013-11-06 16:43 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-22 10:28 - 2013-11-06 16:43 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative 

Tools
2013-11-22 10:28 - 2013-11-06 16:43 - 00000000 ___RD C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-22 10:28 - 2011-03-13 15:15 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-22 10:28 - 2010-06-04 21:24 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-22 10:28 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-11-22 10:28 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-22 10:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-22 10:26 - 2010-06-04 21:24 - 00000000 ____D C:\ProgramData\Skype
2013-11-22 10:19 - 2013-11-21 21:07 - 00000000 ____D C:\Program Files (x86)\mIRC
2013-11-22 10:19 - 2013-11-15 00:58 - 00000000 ___RD C:\Sandbox
2013-11-22 10:19 - 2009-07-14 19:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-11-22 00:59 - 2013-11-08 22:49 - 00006506 _____ C:\Users\Stefan W\Desktop\Diablo II - Accs + d2jsp.txt
2013-11-17 15:35 - 2010-06-04 20:33 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\ICQ
2013-11-15 00:02 - 2013-11-06 16:45 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Local\DoNotTrackPlus
2013-11-14 11:02 - 2013-08-20 16:59 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 14:59 - 2013-11-13 14:59 - 00000033 _____ C:\Users\Stefan W\Desktop\yahoo pw.txt
2013-11-13 10:26 - 2013-11-13 10:26 - 00003416 ____N C:\bootsqm.dat
2013-11-13 10:25 - 2013-11-13 10:25 - 00000000 __SHD C:\found.000
2013-11-06 17:57 - 2013-11-06 17:57 - 00000463 _____ C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2013-11-06 17:06 - 2013-11-06 17:06 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
2013-11-06 16:59 - 2013-11-06 16:59 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Toshiba
2013-11-06 16:49 - 2013-11-06 16:49 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Avira
2013-11-06 16:45 - 2013-11-06 16:45 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\TFPU
2013-11-06 16:44 - 2013-11-06 16:44 - 00096976 _____ C:\Users\Diablo II - Loader\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-06 16:44 - 2013-11-06 16:44 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Intel Corporation
2013-11-06 16:44 - 2013-11-06 16:43 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Local\VirtualStore
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Vorlagen
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Startmenü
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Netzwerkumgebung
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Lokale Einstellungen
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Eigene Dateien
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Druckumgebung
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Documents\Eigene Musik
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Documents\Eigene Bilder
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Local\Verlauf
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\AppData\Local\Anwendungsdaten
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 _SHDL C:\Users\Diablo II - Loader\Anwendungsdaten
2013-11-06 16:43 - 2013-11-06 16:43 - 00000000 ____D C:\Users\Diablo II - Loader\AppData\Roaming\Adobe
2013-11-06 16:33 - 2013-11-06 16:24 - 00000000 ____D C:\Users\Stefan W\VirtualBox VMs
2013-11-06 16:33 - 2013-11-06 16:22 - 00000000 ____D C:\Users\Stefan W\.VirtualBox
2013-11-06 14:53 - 2013-11-05 14:53 - 102753054 _____ C:\Windows\SysWOW64\???Ž
2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2013-11-01 15:03 - 2013-11-01 15:03 - 00021840 _____ C:\Windows\SysWOW64\SIntfNT.dll
2013-11-01 15:03 - 2013-11-01 15:03 - 00017212 _____ C:\Windows\SysWOW64\SIntf32.dll
2013-11-01 15:03 - 2013-11-01 15:03 - 00012067 _____ C:\Windows\SysWOW64\SIntf16.dll
2013-10-31 14:57 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-31 11:35 - 2009-12-13 22:32 - 00632364 _____ C:\Windows\PFRO.log
2013-10-31 09:24 - 2013-10-30 13:15 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-10-30 13:14 - 2013-10-30 13:08 - 00139264 _____ (Blizzard Entertainment) C:\Windows\War3Unin.exe
2013-10-30 13:14 - 2013-10-30 13:08 - 00045065 _____ C:\Windows\War3Unin.dat
2013-10-30 13:14 - 2013-10-30 13:08 - 00002829 _____ C:\Windows\War3Unin.pif
2013-10-30 13:14 - 2013-10-30 13:08 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warcraft III
2013-10-29 08:03 - 2009-12-13 22:34 - 00000000 ____D C:\ProgramData\WildTangent
2013-10-29 08:02 - 2013-10-29 08:02 - 00000000 ____D C:\Users\Stefan W\AppData\Roaming\WildTangent

Some content of TEMP:
====================
C:\Users\Stefan W\AppData\Local\Temp\avgnt.exe
C:\Users\Stefan W\AppData\Local\Temp\binkw32.dll
C:\Users\Stefan W\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Stefan W\AppData\Local\Temp\d2l_Install.exe
C:\Users\Stefan W\AppData\Local\Temp\detectlib2156.dll
C:\Users\Stefan W\AppData\Local\Temp\detectlib2164.dll
C:\Users\Stefan W\AppData\Local\Temp\detectlib2204.dll
C:\Users\Stefan W\AppData\Local\Temp\detectlib2404.dll
C:\Users\Stefan W\AppData\Local\Temp\detectlib2424.dll
C:\Users\Stefan W\AppData\Local\Temp\detectlib2448.dll
C:\Users\Stefan W\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Stefan W\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Stefan W\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Stefan W\AppData\Local\Temp\setup.exe
C:\Users\Stefan W\AppData\Local\Temp\SIntf16.dll
C:\Users\Stefan W\AppData\Local\Temp\SIntf32.dll
C:\Users\Stefan W\AppData\Local\Temp\SIntfNT.dll
C:\Users\Stefan W\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Stefan W\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Stefan W\AppData\Local\Temp\war3_Install.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-12 08:39

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013
Ran by Stefan W at 2013-11-22 13:51:38
Running from D:\kack teil
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32)
Adobe AIR (x32 Version: 1.5.2.8870)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.1) - Deutsch (x32 Version: 10.1.1)
Amazon.de (x32)
Ask Toolbar (x32 Version: 1.15.26.0)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.17)
AuthenTec Fingerprint Software (Version: 8.5.4.46)
Avira Free Antivirus (x32 Version: 14.0.1.719)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.4.1.29781)
Bluetooth Stack for Windows by Toshiba (Version: v7.10.01(T))
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Conexant HD Audio (Version: 4.98.16.61)
Crysis(R) (x32 Version: 1.00.0000)
Diablo II (x32)
Direct DiscRecorder (x32 Version: 1.00.0000)
DVD MovieFactory for TOSHIBA (x32 Version: 7.0.0)
eBay (x32 Version: 1.0.5)
Free M4a to MP3 Converter 6.1 (x32)
Free YouTube to MP3 Converter version 3.11.35.1031 (x32 Version: 3.11.35.1031)
GameSpy Comrade (x32 Version: 1.5.0.156)
GMX Softwareaktualisierung (x32 Version: 2.0.1.9)
GMX Toolbar für Internet Explorer (x32 Version: 1.7.2.0)
GMX Toolbar MSVC100 CRT x64 (Version: 1.0.0)
GMX Toolbar MSVC100 CRT x86 (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32)
HDMI Control Manager (Version: 2.0)
HDMI Control Manager (x32 Version: 2.0)
ICQ Toolbar (x32 Version: 3.0.0)
ICQ7.2 (x32 Version: 7.2)
Intel(R) Control Center (x32 Version: 1.2.0.1006)
Intel(R) Rapid Storage Technology (x32 Version: 9.6.1.1001)
InterVideo WinDVD BD for TOSHIBA (x32 Version: 8.0-B20.185)
Java(TM) 6 Update 14 (x32 Version: 6.0.140)
Junk Mail filter update (x32 Version: 14.0.8089.726)
League of Legends (x32 Version: 3.0.1)
LyricsWoofer (x32)
McAfee Security Scan Plus (Version: 3.8.130.10)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Need for Speed™ Most Wanted (x32)
Nokia Connectivity Cable Driver (x32 Version: 7.1.78.0)
Nokia Suite (x32 Version: 3.4.49.0)
NVIDIA Drivers (Version: 1.9)
NVIDIA PhysX (x32 Version: 9.09.0814)
O2Micro Flash Memory Card Windows Driver (Version: 2.0.24.D)
O2Micro Flash Memory Card Windows Driver (x32 Version: 2.0.24.D)
Pando Media Booster (x32 Version: 2.6.0.7)
PC Connectivity Solution (x32 Version: 12.0.17.0)
Photo Service - powered by myphotobook (x32 Version: 1.0.5)
Photo Service - powered by myphotobook (x32 Version: 1.0.5-124)
PlayReady PC Runtime amd64 (Version: 1.3.0)
PunkBuster Services (x32 Version: 0.986)
QuickTime (x32)
Realtek WLAN Driver (x32 Version: 2.00.0006)
Regi (Version: 1.00.0000)
Skype Toolbars (x32 Version: 1.0.4051)
Skype™ 6.6 (x32 Version: 6.6.106)
Soldat 1.2 (x32)
Steam (x32)
Synaptics Pointing Device Driver (Version: 13.2.7.3)
TFPU (Version: 1.0.0)
Tigerteam 1 (x32)
Toshiba Assist (x32 Version: 3.00.10)
TOSHIBA Bulletin Board (Version: 1.5.06.64)
TOSHIBA Bulletin Board (x32 Version: 1.5.06.64)
TOSHIBA ConfigFree (x32 Version: 8.0.25)
TOSHIBA Disc Creator (Version: 2.1.0.2 for x64)
TOSHIBA DVD PLAYER (x32 Version: 3.01.1.07-A)
TOSHIBA eco Utility (Version: 1.2.11.64)
TOSHIBA eco Utility (x32 Version: 1.2.11.64)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Extended Tiles for Windows Mobility Center (x32 Version: )
TOSHIBA Face Recognition (Version: 3.1.3.64)
TOSHIBA Face Recognition (x32 Version: 3.1.3.64)
TOSHIBA Fingerprint Utility (Version: 1.0.2.18)
TOSHIBA Hardware Setup (Version: 4.02.01.00)
TOSHIBA Hardware Setup (x32 Version: 4.02.01.00)
TOSHIBA HDD Protection (Version: 2.2.0.3)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6)
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6)
Toshiba Manuals (x32 Version: 10.00)
Toshiba Online Product Information (x32 Version: 2.08.0001)
TOSHIBA PC Health Monitor (Version: 1.5.1.64)
TOSHIBA Recovery Media Creator (Version: 2.1.0.4 x64)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019)
TOSHIBA ReelTime (Version: 1.5.08.64)
TOSHIBA ReelTime (x32 Version: 1.5.08.64)
TOSHIBA Service Station (x32 Version: 2.1.40)
TOSHIBA Supervisor Password (Version: 4.02.01.00)
TOSHIBA Supervisor Password (x32 Version: 4.02.01.00)
TOSHIBA TEMPRO (x32 Version: 3.35)
TOSHIBA USB Sleep and Charge Utility (x32 Version: 1.3.2.0)
TOSHIBA Value Added Package (Version: 1.2.34.64)
TOSHIBA Value Added Package (x32 Version: 1.2.34.64)
TOSHIBA Web Camera Application (x32 Version: 1.1.1.10)
TRORMCLauncher (Version: 1.0.0.9)
TRORMCLauncher (x32 Version: )
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VideoLAN VLC media player 0.8.5 (x32 Version: 0.8.5)
Warcraft III (x32)
Warcraft III: All Products (HKCU)
WildTangent-Spiele (x32 Version: 1.0.0.71)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
WinRAR archiver

==================== Restore Points  =========================

11-10-2013 19:56:53 Installed League of Legends
11-10-2013 19:57:56 DirectX wurde installiert
11-10-2013 22:05:54 Windows Update
15-10-2013 00:03:40 Windows Update
06-11-2013 15:16:46 Installed Oracle VM VirtualBox 4.3.2
06-11-2013 15:20:32 Installed Oracle VM VirtualBox 4.3.2
06-11-2013 15:35:23 Removed Oracle VM VirtualBox 4.3.2
14-11-2013 09:55:49 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {091ACEF7-F339-4D89-A9A4-F9D4AE1E198E} - System32\Tasks\{D6666C49-9FE9-4D22-920C-A81EFFC8EDFD} => Iexplore.exe 

hxxp://ui.skype.com/ui/0/6.6.0.106/de/go/help.faq.installer?LastError=1618
Task: {9E686777-D901-486A-B30A-1B62509F6638} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-

04-30] ()
Task: {9EB786B9-1AED-434A-A06A-1B463B9980A3} - System32\Tasks\LyricsWoofer Update => C:\Program Files (x86)\LyricsWoofer\LyricsWooferUPD.exe
Task: {A2C24713-133D-4C92-A43D-92760BE9AE3A} - System32\Tasks\{BDBA7845-8627-4B67-89C5-E92D5FB2068D} => C:\Program Files (x86)\Skype\Phone\Skype.exe 

[2013-06-21] (Skype Technologies S.A.)
Task: {C9F84DEE-BDF3-4F3C-A750-891636A0BF4D} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung

\cdsupdclient.exe [2011-07-28] (1&1 Mail & Media GmbH)
Task: {CA1BD6E5-3ACE-465C-B16E-33F4544A02EF} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM

\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: {EDF0D036-C6E4-46A9-8F84-0D92B71E7175} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe 

[2009-10-28] (TOSHIBA CORPORATION)
Task: {EF661AB4-A34B-4D47-A713-DD1D7936B36C} - System32\Tasks\{C7B360C1-BC84-4418-8657-10DA31723938} => Iexplore.exe 

hxxp://ui.skype.com/ui/0/6.6.0.106/de/go/help.faq.installer?LastError=1618
Task: {FEBD7FC1-4E84-4B5D-ABF4-DCDD3073B8F9} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft 

Corporation)
Task: C:\Windows\Tasks\LyricsWoofer Update.job => C:\Program Files (x86)\LyricsWoofer\LyricsWooferUPD.exe

==================== Loaded Modules (whitelisted) =============

2010-06-18 16:05 - 2010-03-15 10:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2009-11-02 09:16 - 2009-11-02 09:16 - 00359856 _____ () C:\Program Files\TOSHIBA\TFPU\TFPUCommon.dll
2009-10-18 15:20 - 2009-10-18 15:20 - 07959864 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll
2009-11-03 13:26 - 2009-11-03 13:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2009-12-13 22:14 - 2009-06-22 14:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
2009-03-12 19:08 - 2009-03-12 19:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 16:38 - 2009-07-25 16:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2010-04-06 13:53 - 2010-04-06 13:53 - 00578936 _____ () C:\Program Files\Toshiba\TECO\TecoPower.dll
2009-11-02 09:16 - 2009-11-02 09:16 - 00359856 _____ () C:\Program Files\Toshiba\TFPU\TFPUCommon.dll
2009-11-30 11:06 - 2009-11-30 11:06 - 03241320 _____ () C:\Program Files\Toshiba\BulletinBoard\TosNcUi.dll
2010-02-05 16:44 - 2010-02-05 16:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2012-10-25 11:32 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2010-02-07 11:30 - 2009-10-02 13:18 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-10-25 11:32 - 2012-09-19 18:17 - 00397088 _____ () C:\program files (x86)\avira\antivir desktop\sqlite3.dll
2009-11-02 09:16 - 2009-11-02 09:16 - 00244144 _____ () C:\Program Files\TOSHIBA\TFPU\x86\TFPUCommon.dll
2013-03-10 22:39 - 2013-03-10 22:39 - 00597880 _____ () C:\Program Files (x86)\Ask.com\AbineSDK\IE\DNTPContentFilter.dll
2013-03-10 22:39 - 2013-03-10 22:39 - 00051728 _____ () C:\Program Files (x86)\Ask.com\AbineSDK\IE\DNTPServicePS.dll
2013-03-10 22:39 - 2013-03-10 22:39 - 00227192 _____ () C:\Program Files (x86)\Ask.com\AbineSDK\IE\DNTPButton.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/22/2013 10:51:51 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x155c
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (11/22/2013 10:50:58 AM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!

Error: (11/22/2013 10:41:56 AM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!

Error: (11/22/2013 10:39:18 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Name des fehlerhaften Moduls: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000278b6
ID des fehlerhaften Prozesses: 0x6e8
Startzeit der fehlerhaften Anwendung: 0xavscan.exe0
Pfad der fehlerhaften Anwendung: avscan.exe1
Pfad des fehlerhaften Moduls: avscan.exe2
Berichtskennung: avscan.exe3

Error: (11/22/2013 10:38:26 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Name des fehlerhaften Moduls: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000278b6
ID des fehlerhaften Prozesses: 0x634
Startzeit der fehlerhaften Anwendung: 0xavscan.exe0
Pfad der fehlerhaften Anwendung: avscan.exe1
Pfad des fehlerhaften Moduls: avscan.exe2
Berichtskennung: avscan.exe3

Error: (11/22/2013 10:36:05 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Name des fehlerhaften Moduls: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000278b6
ID des fehlerhaften Prozesses: 0x1a8
Startzeit der fehlerhaften Anwendung: 0xavscan.exe0
Pfad der fehlerhaften Anwendung: avscan.exe1
Pfad des fehlerhaften Moduls: avscan.exe2
Berichtskennung: avscan.exe3

Error: (11/22/2013 10:35:32 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Name des fehlerhaften Moduls: avscan.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6bacc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000278b6
ID des fehlerhaften Prozesses: 0x4f0
Startzeit der fehlerhaften Anwendung: 0xavscan.exe0
Pfad der fehlerhaften Anwendung: avscan.exe1
Pfad des fehlerhaften Moduls: avscan.exe2
Berichtskennung: avscan.exe3

Error: (11/21/2013 09:06:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (11/19/2013 03:38:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16736, Zeitstempel: 0x5258c4cc
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0xb54
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (11/19/2013 09:34:28 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000008
Fehleroffset: 0x00000000000cd7e8
ID des fehlerhaften Prozesses: 0x7d4
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3


System errors:
=============
Error: (11/22/2013 01:44:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 

Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/22/2013 11:03:19 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Notebook Performance Tuning Service (TEMPRO) erreicht.

Error: (11/22/2013 10:59:57 AM) (Source: Service Control Manager) (User: )
Description: Dienst "Wsys Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/22/2013 10:41:55 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.

Error: (11/22/2013 10:41:49 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.

Error: (11/22/2013 10:32:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht 

gestartet wurde: 
%%1068

Error: (11/22/2013 10:32:17 AM) (Source: DCOM) (User: )
Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}

Error: (11/22/2013 10:32:17 AM) (Source: DCOM) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}

Error: (11/22/2013 10:31:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht 

gestartet wurde: 
%%1068

Error: (11/22/2013 10:31:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht 

gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 8180.48 MB
Available physical RAM: 5167.34 MB
Total Pagefile: 16359.13 MB
Available Pagefile: 12768.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:149.01 GB) (Free:91.86 GB) NTFS
Drive d: (Data) (Fixed) (Total:148.69 GB) (Free:23.93 GB) NTFS
Drive f: () (Fixed) (Total:298.09 GB) (Free:116.77 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 4442DD8E)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 5749E1EA)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-22 14:22:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.FG02 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\STEFAN~1\AppData\Local\Temp\uxddypob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                             

        fffff800033bb000 63 bytes [00, 00, 9F, 00, 43, 63, 42, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                             

        fffff800033bb042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                     

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1624] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                        

        00000000740a1a22 2 bytes [0A, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1624] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                        

        00000000740a1ad0 2 bytes [0A, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1624] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                        

        00000000740a1b08 2 bytes [0A, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1624] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                        

        00000000740a1bba 2 bytes [0A, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1624] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                        

        00000000740a1bda 2 bytes [0A, 74]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35              

        000000006bf711a8 2 bytes [F7, 6B]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21        

        000000006bf713a8 2 bytes [F7, 6B]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21            

        000000006bf71422 2 bytes [F7, 6B]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19     

        000000006bf71498 2 bytes [F7, 6B]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\d3d8thk.dll!

OsThunkDdWaitForVerticalBlank + 195  0000000073c61b41 2 bytes [C6, 73]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\d3d8thk.dll!

OsThunkDdWaitForVerticalBlank + 362  0000000073c61be8 2 bytes [C6, 73]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\d3d8thk.dll!

OsThunkDdWaitForVerticalBlank + 418  0000000073c61c20 2 bytes [C6, 73]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\d3d8thk.dll!

OsThunkDdWaitForVerticalBlank + 596  0000000073c61cd2 2 bytes [C6, 73]
.text     C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[196] C:\Windows\SysWOW64\d3d8thk.dll!

OsThunkDdWaitForVerticalBlank + 628  0000000073c61cf2 2 bytes [C6, 73]
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            

        0000000076321465 2 bytes [32, 76]
.text     C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[6504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                           

        00000000763214bb 2 bytes [32, 76]
.text     ...                                                                                                                                            

        * 2

---- EOF - GMER 2.1 ----