Win7: Snap.Do und Internet Probleme

T04ST3R · 29.11.2013, 15:32

Hallo liebes Trojaner Board Team,
ich habe folgendes Problem: In letzter Zeit passiert es ab und zu, das Internetseiten länger zum laden brauchen, obwohl mein Bruder (der am selben Router hängt) nichts der gleichen bemerkt (selbst wenn er nichts an seinem Pc downloaded oder ähnliches). Deshalb wollte ich erstmal meine Computer mit CCleaner reinigen, aber als ich die Datei über die Windows suche gesucht hatte und angegklickt habe, meldete Antivir:

Code:

ATTFilter

In der Datei 'C:\Users\Tobias\Downloads\ccleaner-deutsch.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/InstallShare.AC.1' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern

Ich habe es dann in Quarantäne geschoben. Danach hatte ich den Snap.Do Trojaner drauf. Deshalb habe ich nun CCleaner neu heruntergeladen und damit dann alle Snap.Do Programme deinstalliert. Und meinen Computer mit CCleaner aufgeräumt. Die Snap.Do Startseite bleibt aber weiterhin im Browser.
Deshalb wäre es nett wenn ihr das ganze mal überprüfen könntet.
Sind leider über 120000 Zeichen, deswegen Logs im Anhang.
Vielen Dank im voraus

Mit freundlichen Grüßen Tobi

schrauber · 29.11.2013, 16:29

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

T04ST3R · 29.11.2013, 16:47

Ok tut mir leid ich bin auf vorschau gegangen und da stand das ich es gezippt hochladen soll, da es mehr als so und so viel zeichen waren.

defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:31 on 29/11/2013 (Tobias)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-11-2013
Ran by Tobias (administrator) on TOASTER on 29-11-2013 15:19:19
Running from C:\Users\Tobias\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\WINDOWS\System32\atiesrxx.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(AMD) C:\WINDOWS\System32\atieclxx.exe
(Aventail Corporation) C:\WINDOWS\System32\ngvpnmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Optimizer Pro\OptProCrash.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\WINDOWS\SysWOW64\PnkBstrA.exe
(SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Spotify Ltd) C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Dropbox, Inc.) C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
() C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(PC Utilities Pro) C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(PC Utilities Pro) C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Code Systems Corporation) C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-07] (Realtek Semiconductor)
HKLM\...\Run: [RunDLLEntry_THXCfg] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [RunDLLEntry_EptMon] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\EptMon64.dll,RunDLLEntry EptMon64
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-06-26] (Sonic Solutions)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-19] (Google Inc.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-07] (Spotify Ltd)
HKCU\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [134648 2013-10-28] ()
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2009-07-17] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-09-11] ()
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdReg] - C:\WINDOWS\Updreg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
AppInit_DLLs: C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll [2603312 2013-11-29] ()
AppInit_DLLs-x32: c:\progra~2\optimi~1\optpro~1.dll [2869720 2013-10-29] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Console.lnk
ShortcutTarget: Spoon.net Console.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Console.exe (Code Systems Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Sandbox Manager 3.33.lnk
ShortcutTarget: Spoon.net Sandbox Manager 3.33.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox-Native.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Re-markit - {1ad7fd01-f45b-4863-a047-8b2a3735b829} - C:\Program Files (x86)\Re-markit\135.dll ()
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default
FF Homepage: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013
FF SelectedSearchEngine: Web Search
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&installDate=29/11/2013&q=
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @idsoftware.com/QuakeLive - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @spoon.net/Spoon Plugin 3.33 - C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\npMozillaSpoonPlugin.dll (Code Systems Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: qlping.com/qlping - C:\Users\Tobias\AppData\Local\qlPing\0.0.1.0\npqlping.dll (qlping)
FF SearchPlugin: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\searchplugins\Web Search.xml
FF Extension: No Name - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\staged
FF Extension: DownloadHelper - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Adblock Plus - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF HKCU\...\Firefox\Extensions: [{5ce3e0cb-aa83-45cb-a7da-a2684f05b8f3}] - C:\Program Files (x86)\Re-markit\135.xpi
FF Extension: No Name - C:\Program Files (x86)\Re-markit\135.xpi

Chrome: 
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013
CHR RestoreOnStartup: "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013"
CHR DefaultSearchURL: (Google) - https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultSuggestURL: (Google) - https://www.google.com/complete/search?q={searchTerms}
CHR Extension: (Snap.Do ) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0
CHR Extension: (Re-markit) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel\1.135_0
CHR Extension: (Google Wallet) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_1
CHR HKLM-x32\...\Chrome\Extension: [dcpfhaghaadpjpgocojgnlhjcieeooel] - C:\Program Files (x86)\Re-markit\135.crx
CHR StartMenuInternet: Google Chrome - C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrash.exe [143488 2013-11-29] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation)
R2 NgVpnMgr; C:\Windows\system32\ngvpnmgr.exe [543016 2013-10-24] (Aventail Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-16] ()
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation)
S2 SessionLauncher; c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-16] (DT Soft Ltd)
R0 ESLWireAC; C:\Windows\System32\drivers\ESLWireACD.sys [183312 2013-08-04] (<Turtle Entertainment>)
S3 NgFilter; C:\Windows\System32\DRIVERS\ngfilter.sys [26184 2013-10-23] (Aventail Corporation)
R3 NgLog; C:\Windows\System32\DRIVERS\nglog.sys [31304 2013-10-23] (Aventail Corporation)
R3 NgVpn; C:\Windows\System32\DRIVERS\ngvpn.sys [103496 2013-10-23] (Aventail Corporation)
R3 NgWfp; C:\Windows\System32\DRIVERS\ngwfp.sys [28744 2013-10-23] (Aventail Corporation)
S1 RxFilter; C:\Windows\SysWow64\DRIVERS\RxFilter.sys [65520 2009-06-26] (Sonic Solutions)
S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)
S3 XONE_DX; C:\Windows\System32\Drivers\XONE_DX.sys [398400 2011-08-10] (Ploytec GmbH)
S3 XONE_DXM; C:\Windows\System32\drivers\XONE_DXM.sys [31296 2011-08-10] (Ploytec GmbH)
S3 XONE_DX_WDM; C:\Windows\System32\drivers\XONE_DXW.sys [50240 2011-08-10] (Ploytec GmbH)
S3 ESEADriver2; \??\C:\Users\Tobias\AppData\Local\Temp\ESEADriver2.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-29 15:17 - 2013-11-29 15:19 - 00020241 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.log
2013-11-29 14:35 - 2013-11-29 14:52 - 00000705 _____ C:\Users\Tobias\Desktop\gmeranleitung.txt
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.log
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:28 - 2013-11-29 14:28 - 01959024 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-11-29 14:54 - 00000168 _____ C:\Windows\setupact.log
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-29 12:51 - 2013-11-29 14:54 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\Documents\Optimizer Pro
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Optimizer Pro
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-29 12:50 - 2013-11-29 14:57 - 00000386 _____ C:\Windows\Tasks\Re-markit Update.job
2013-11-29 12:50 - 2013-11-29 12:50 - 00003036 _____ C:\Windows\System32\Tasks\Re-markit Update
2013-11-29 12:50 - 2013-11-29 12:50 - 00000000 ____D C:\Program Files (x86)\Re-markit
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-13 17:28 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 17:28 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 17:28 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 17:28 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 17:28 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 17:28 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 17:28 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 17:28 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 17:28 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 17:28 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 14:50 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:38 - 2013-11-07 19:39 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-25 15:25 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-04 19:20 - 2013-09-22 19:12 - 00064794 _____ C:\Users\Tobias\Documents\WarthunderPS3controllerV2.blk
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 19:54 - 2013-11-02 23:31 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 19:54 - 2013-11-02 23:30 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

==================== One Month Modified Files and Folders =======

2013-11-29 15:19 - 2013-11-29 15:17 - 00020241 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-11-29 15:03 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-29 15:03 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-29 15:00 - 2009-07-14 18:58 - 00699416 _____ C:\Windows\system32\perfh007.dat
2013-11-29 15:00 - 2009-07-14 18:58 - 00149556 _____ C:\Windows\system32\perfc007.dat
2013-11-29 15:00 - 2009-07-14 06:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-29 15:00 - 2009-07-14 06:10 - 01115642 _____ C:\Windows\WindowsUpdate.log
2013-11-29 14:59 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Dropbox
2013-11-29 14:57 - 2013-11-29 12:50 - 00000386 _____ C:\Windows\Tasks\Re-markit Update.job
2013-11-29 14:56 - 2012-10-11 17:18 - 00000000 ___RD C:\Users\Tobias\Dropbox
2013-11-29 14:55 - 2012-07-19 22:55 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA.job
2013-11-29 14:54 - 2013-11-29 13:21 - 00000168 _____ C:\Windows\setupact.log
2013-11-29 14:54 - 2013-11-29 12:51 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-29 14:54 - 2013-05-08 19:22 - 00000604 _____ C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2013-11-29 14:54 - 2012-07-09 22:35 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-29 14:54 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-29 14:52 - 2013-11-29 14:35 - 00000705 _____ C:\Users\Tobias\Desktop\gmeranleitung.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.log
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.log
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:31 - 2012-07-09 21:26 - 00000000 ____D C:\Users\Tobias
2013-11-29 14:28 - 2013-11-29 14:28 - 01959024 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-29 12:56 - 2012-08-16 13:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\DAEMON Tools Lite
2013-11-29 12:55 - 2010-01-09 01:40 - 00000000 ____D C:\Windows\Panther
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\Documents\Optimizer Pro
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Optimizer Pro
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-11-29 12:51 - 2013-11-29 12:51 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-29 12:51 - 2012-08-20 11:38 - 00000000 ____D C:\Program Files\CCleaner
2013-11-29 12:51 - 2012-07-09 21:26 - 00000000 ___RD C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-29 12:50 - 2013-11-29 12:50 - 00003036 _____ C:\Windows\System32\Tasks\Re-markit Update
2013-11-29 12:50 - 2013-11-29 12:50 - 00000000 ____D C:\Program Files (x86)\Re-markit
2013-11-28 21:55 - 2012-07-19 22:55 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core.job
2013-11-28 21:50 - 2012-07-19 22:55 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA
2013-11-28 21:50 - 2012-07-19 22:55 - 00003700 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core
2013-11-28 17:34 - 2013-05-08 19:25 - 00000000 ____D C:\Users\Tobias\Documents\MATLAB
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\ProgramData\Aventail
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\Program Files\Aventail Connect
2013-11-25 15:25 - 2013-11-07 18:37 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-25 14:11 - 2013-08-08 10:10 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 18:11 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-22 17:54 - 2012-09-25 14:53 - 00001870 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-11-21 23:18 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-20 22:04 - 2012-07-10 11:36 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\TS3Client
2013-11-19 17:40 - 2013-07-03 15:10 - 00000000 ____D C:\Users\Tobias\Documents\Schule
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-15 20:59 - 2013-05-11 15:49 - 00015364 ____H C:\Users\Tobias\.DS_Store
2013-11-14 17:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 18:20 - 2012-07-09 21:33 - 00001427 _____ C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-12 18:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-08 11:13 - 2013-02-13 23:15 - 00000000 ____D C:\Users\Tobias\Documents\Playstation Gems
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:39 - 2013-11-07 19:38 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-06 21:54 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-02 23:31 - 2013-11-02 19:54 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 23:30 - 2013-11-02 19:54 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

Files to move or delete:
====================
C:\Users\Tobias\AppData\Roaming\Camdata.ini
C:\Users\Tobias\AppData\Roaming\CamLayout.ini
C:\Users\Tobias\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\avgnt.exe
C:\Users\Tobias\AppData\Local\Temp\BackupSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-21 16:49

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-11-2013
Ran by Tobias at 2013-11-29 15:19:42
Running from C:\Users\Tobias\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Tools for .Net 3.5 - DEU Lang Pack (x32 Version: 3.11.50727)
 Tools for .Net 3.5 (x32 Version: 3.11.50727)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.22.87)
Adobe Flash Player 11 Plugin (x32 Version: 11.4.402.265)
Adobe Reader X (10.1.4) - Deutsch (x32 Version: 10.1.4)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Install Manager (Version: 8.0.903.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.71219.1540)
Anki (x32)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
Audacity 2.0.3 (x32 Version: 2.0.3)
Audiograbber 1.83 SE  (x32 Version: 1.83 SE )
Audiograbber MP3-Plugin (64 bit) (x32 Version: 1.0)
Aventail Access Manager (HKCU Version: 10.61.165)
Aventail Access Manager (x32 Version: 10.61.165)
Aventail Connect (Version: 10.63.342)
Aventail Web Proxy Agent (x32 Version: 10.61.130)
Avira Free Antivirus (x32 Version: 14.0.1.749)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlelog Web Plugins (x32 Version: 2.1.7)
Beatport Downloader (x32 Version: 1.4)
Bing Bar (x32 Version: 7.0.850.0)
Blend for Visual Studio 2012 (x32 Version: 5.0.30709.0)
Blend for Visual Studio 2012 DEU resources (x32 Version: 5.0.30709.0)
Bonjour (Version: 3.0.0.10)
Brother MFL-Pro Suite MFC-7360N (x32 Version: 1.0.9.0)
Burnout Paradise: The Ultimate Box (x32)
CamStudio version 2.7 (x32 Version: 2.7)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center InstallProxy (x32 Version: 2009.0918.2132.36825)
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485)
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485)
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485)
CCC Help Czech (x32 Version: 2012.1219.1520.27485)
CCC Help Danish (x32 Version: 2012.1219.1520.27485)
CCC Help Dutch (x32 Version: 2012.1219.1520.27485)
CCC Help English (x32 Version: 2012.1219.1520.27485)
CCC Help Finnish (x32 Version: 2012.1219.1520.27485)
CCC Help French (x32 Version: 2012.1219.1520.27485)
CCC Help German (x32 Version: 2012.1219.1520.27485)
CCC Help Greek (x32 Version: 2012.1219.1520.27485)
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485)
CCC Help Italian (x32 Version: 2012.1219.1520.27485)
CCC Help Japanese (x32 Version: 2012.1219.1520.27485)
CCC Help Korean (x32 Version: 2012.1219.1520.27485)
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485)
CCC Help Polish (x32 Version: 2012.1219.1520.27485)
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485)
CCC Help Russian (x32 Version: 2012.1219.1520.27485)
CCC Help Spanish (x32 Version: 2012.1219.1520.27485)
CCC Help Swedish (x32 Version: 2012.1219.1520.27485)
CCC Help Thai (x32 Version: 2012.1219.1520.27485)
CCC Help Turkish (x32 Version: 2012.1219.1520.27485)
ccc-utility64 (Version: 2012.1219.1521.27485)
CCleaner (Version: 4.05)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Counter-Strike: Global Offensive Beta (x32)
Counter-Strike: Source (x32)
Crysis 2 Maximum Edition (x32)
DAEMON Tools Lite (x32 Version: 4.45.4.0314)
Dead Space (x32)
Dell DataSafe Local Backup - Support Software (x32 Version: 2.31)
Dell DataSafe Local Backup (x32 Version: 9.3.44)
Dell DataSafe Online (x32 Version: 1.1.0031)
Dell Dock (Version: 2.0.0)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (x32 Version: 1.00.0000)
Dell Support Center (Support Software) (x32 Version: 2.5.09100)
Devenv-Ressourcen für Microsoft Visual Studio 2012 (x32 Version: 11.0.50727)
DirectXInstallService (x32 Version: 9.0.2)
DMUninstaller (x32)
Dota 2 (x32)
Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4521.29298)
Dotfuscator and Analytics Community Edition Language Pack (x32 Version: 5.5.4521.29298)
Dropbox (HKCU Version: 2.4.6)
EMC 10 Content (x32 Version: 1.0.035)
EMCGadgets64 (Version: 1.0.302)
Entity Framework Designer für Visual Studio 2012 - DEU (x32 Version: 11.1.20702.00)
Erforderliche Komponenten für SSDT  (x32 Version: 11.0.2100.60)
ESL Wire 1.17.2
ESN Sonar (x32 Version: 0.70.4)
Fraps (x32)
Freemake Video Converter Version 4.0.4 (x32 Version: 4.0.4)
Gamers.IRC 5.25 (x32)
Google Chrome (HKCU Version: 31.0.1650.57)
Half-Life 2: Episode One (x32)
Half-Life 2: Episode Two (x32)
Heroes of Newerth (x32 Version: 2.3.0)
HLSW v1.4.0.2 (x32)
iCloud (Version: 2.1.1.3)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x64
IIS Express Application Compatibility Database for x86
Intel(R) Control Center (x32 Version: 1.2.0.1006)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.1952)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.0.1037)
ITCH (x32 Version: 2.2.0)
iTunes (Version: 11.0.1.12)
Java 7 Update 7 (x32 Version: 7.0.70)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 14 (64-bit) (Version: 6.0.140)
Java(TM) 6 Update 33 (x32 Version: 6.0.330)
Junk Mail filter update (x32 Version: 14.0.8089.726)
LAME v3.99.3 (for Windows) (x32)
Left 4 Dead 2 (x32)
LocalESPC (x32 Version: 8.59.25584)
LocalESPCui for de-de (x32 Version: 8.59.25584)
Maple 16
Maple 16 (x32 Version: 16.0.0.0)
MATLAB R2013a Student Version (32-bit) (x32 Version: 8.1)
Metro 2033 (x32)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (x32 Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (x32 Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (x32 Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft ASP.NET MVC 3 - DEU (x32 Version: 3.0.20105.0)
Microsoft ASP.NET MVC 3 - Visual Studio 2012 Tools Update - DEU (x32 Version: 3.0.30710.0)
Microsoft ASP.NET MVC 3 - Visual Studio 2012 Tools Update (x32 Version: 3.0.30710.0)
Microsoft ASP.NET MVC 3 (x32 Version: 3.0.20105.0)
Microsoft ASP.NET MVC 4 - Visual Studio 2012 Tools - DEU (x32 Version: 4.0.20710.0)
Microsoft ASP.NET MVC 4 - Visual Studio 2012 Tools (x32 Version: 4.0.20710.0)
Microsoft ASP.NET MVC 4 Runtime - DEU (x32 Version: 4.0.20710.0)
Microsoft ASP.NET MVC 4 Runtime (x32 Version: 4.0.20710.0)
Microsoft ASP.NET Web Pages - DEU (x32 Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages - Visual Studio 2012 Tools - DEU (x32 Version: 1.0.20710.0)
Microsoft ASP.NET Web Pages - Visual Studio 2012 Tools (x32 Version: 1.0.20710.0)
Microsoft ASP.NET Web Pages (x32 Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages 2 - Visual Studio 2012 Tools - DEU (x32 Version: 2.0.20710.0)
Microsoft ASP.NET Web Pages 2 - Visual Studio 2012 Tools (x32 Version: 2.0.20710.0)
Microsoft ASP.NET Web Pages 2 Runtime - DEU (x32 Version: 2.0.20710.0)
Microsoft ASP.NET Web Pages 2 Runtime (x32 Version: 2.0.20710.0)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Help Viewer 2.0 (x32 Version: 2.0.50727)
Microsoft Help Viewer 2.0 Language Pack - DEU (x32 Version: 2.0.50727)
Microsoft Keyboard Layout Creator 1.4 (x32 Version: 1.4.6000)
Microsoft LightSwitch for Visual Studio 2012 Core (x32 Version: 11.0.50727)
Microsoft LightSwitch für Visual Studio 2012 CoreRes - DEU (x32 Version: 11.0.50727)
Microsoft NuGet - Visual Studio 2012 (x32 Version: 2.0.30625.9003)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Portable Library Multi-Targeting Pack (x32 Version: 11.0.50709.17929)
Microsoft Portable Library Multi-Targeting Pack Language Pack - deu (x32 Version: 11.0.50709.17929)
Microsoft Report Viewer Add-On for Visual Studio 2012 (x32 Version: 11.1.2802.16)
Microsoft Report Viewer Add-On für Visual Studio 2012 (x32 Version: 11.1.2802.16)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Silverlight 4 SDK - Deutsch (x32 Version: 4.0.60310.0)
Microsoft Silverlight 5 SDK - DEU (x32 Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework  (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Data-Tier App Framework  (x32 Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (x32 Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (x64) (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service  (x32 Version: 11.0.2100.60)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (11.1.20627.00) (x32 Version: 11.1.20627.00)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20627.00) (x32 Version: 11.1.20627.00)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1600.1)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1600.1)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012  x64 Designtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 Compilers - DEU Resources (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 Compilers (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 Core Libraries (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 Extended Libraries (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 Microsoft Foundation Class Libraries (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 11.0.50727)
Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU (Version: 11.0.50727)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2012 Devenv (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 SharePoint Developer Tools (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 SharePoint Developer Tools DEU Language Pack (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell-(Mindest)-Ressourcen (x32 Version: 11.0.50727)
Microsoft Visual Studio 2012 Tools für SQL Server Compact 4.0 SP1 DEU (x32 Version: 4.0.8876.1)
Microsoft Visual Studio 2012-Leistungserfassungstools - DEU (Version: 11.0.50727)
Microsoft Visual Studio 2012-Leistungserfassungstools (Version: 11.0.50727)
Microsoft Visual Studio 2012-Vorbereitung (x32 Version: 11.0.50727)
Microsoft Visual Studio Express 2012 für das Web - DEU (x32 Version: 11.0.50727.1)
Microsoft Visual Studio Professional 2012 - DEU (x32 Version: 11.0.50727)
Microsoft Visual Studio Professional 2012 (x32 Version: 11.0.50727)
Microsoft Visual Studio Professional 2012 (x32 Version: 11.0.50727.1)
Microsoft Visual Studio Team Foundation Server 2012 Object Model (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - DEU (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer (x32 Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - DEU (x32 Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core (x32 Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer deu Resources (x32 Version: 11.0.50727)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Deploy dbSqlPackage Provider - DEU (x32 Version: 10.3.20225.0)
Microsoft Web Developer Tools - Visual Studio 2012 - DEU (x32 Version: 1.0.30710.0)
Microsoft Web Developer Tools - Visual Studio 2012 (x32 Version: 1.0.30710.0)
Microsoft Web Platform Installer 4.0 (Version: 4.0.1622)
Microsoft Works (x32 Version: 9.7.0621)
Microsoft-System-CLR-Typen für SQL Server 2012 (x32 Version: 11.0.2100.60)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (Version: 11.0.2100.60)
MiKTeX 2.9 (x32 Version: 2.9)
MotioninJoy Gamepad tool 0.7.0000 (Version: 0.7.0000)
Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1)
Mozilla Maintenance Service (x32 Version: 20.0.1)
Mp3tag v2.52 (x32 Version: v2.52)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia Card Reader (x32 Version: 1.4.915.1)
MuPAD Pro 4.0.6 (x32 Version: 4.0.6)
MyPC Backup  (Version: )
Native Instruments Controller Editor (Version: 1.5.2.1142)
Native Instruments Controller Editor (x32)
Native Instruments Service Center (Version: 2.3.2.926)
Native Instruments Service Center (x32)
Native Instruments Traktor 2 (Version: 2.6.0.14627)
Native Instruments Traktor 2 (x32)
NVIDIA PhysX (x32 Version: 9.10.0222)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Optimizer Pro v3.2 (x32) <==== ATTENTION
Origin (x32 Version: 9.3.1.4482)
Portal 2 (x32)
PowerDVD DX (x32 Version: 8.3.5424)
PreEmptive Analytics Client German Language Pack (x32 Version: 1.0.2180.1)
PreEmptive Analytics Visual Studio Components (x32 Version: 1.0.2180.1)
Project64 1.6 (x32 Version: 1.6)
PunkBuster Services (x32 Version: 0.991)
QLPrism (x32 Version: 4.400)
Quake Live Mozilla Plugin (x32 Version: 1.0.520)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5953)
Re-markit (x32)
Roxio Activation Module (x32 Version: 1.0)
Roxio BackOnTrack (x32 Version: 1.3.0)
Roxio Central Audio (x32 Version: 3.8.0)
Roxio Central Copy (x32 Version: 3.8.0)
Roxio Central Core (x32 Version: 3.8.0)
Roxio Central Data (x32 Version: 3.8.0)
Roxio Central Tools (x32 Version: 3.8.0)
Roxio Easy CD and DVD Burning (x32 Version: 10.3)
Roxio Easy CD and DVD Burning (x32 Version: 10.3.106)
Roxio Express Labeler 3 (x32 Version: 3.2.1)
Roxio File Backup (Version: 1.3.0)
Roxio Update Manager (x32 Version: 6.0.0)
Secure Download Manager (x32 Version: 3.0.5)
ShootMania Storm Open Beta (x32)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
Source SDK Base 2007 (x32)
Spoon.net Sandbox Manager 3.33 (HKCU Version: 3.33.6.119)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
StarCraft II (x32)
Steam (x32 Version: 1.0.0.0)
Team Fortress 2 (x32)
TeamSpeak 3 Client (HKCU Version: 3.0.13)
TeXstudio 2.6.6 (x32 Version: 2.6.6)
THX TruStudio PC (x32 Version: 1.0)
TrackMania Nations Forever (x32)
Update for  (KB2504637) (x32 Version: 1)
Update for Microsoft Visual Studio 2012 (KB2781514) (x32 Version: 11.0.50727)
VCam 3.1.1 (x32)
VD64Inst (Version: 1.00.0000)
Visual Studio 2012 Prerequisites - DEU Language Pack (Version: 11.0.50727)
Visual Studio 2012 Prerequisites (Version: 11.0.50727)
Visual Studio Extensions for Windows Library for JavaScript (x32 Version: 1.0.8514.0)
VLC media player 2.0.6 (x32 Version: 2.0.6)
War Thunder Launcher 1.0.1.278 (x32)
WCF Data Services 5.0 (for OData v3) DEU Language Pack (x32 Version: 5.0.50628.0)
WCF Data Services 5.0 (for OData v3) Primary Components (x32 Version: 5.0.50628.0)
WCF Data Services Tools for Microsoft Visual Studio 2012 (x32 Version: 5.0.50710.0)
WCF Data Services Tools for Visual Studio 11 DEU Language Pack (x32 Version: 5.0.50710.0)
WCF RIA Services V1.0 SP2 (x32 Version: 4.1.61829.0)
Windows App Certification Kit Native Components (Version: 8.59.25584)
Windows App Certification Kit x64 (x32 Version: 8.59.25584)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows Runtime Intellisense Content - de-de (x32 Version: 8.59.25584)
Windows Software Development Kit (x32 Version: 8.59.25584)
Windows Software Development Kit DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit DirectX x86 Remote (x32 Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps (x32 Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (x32 Version: 8.59.25584)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
Wolf Whisperer version 1.3.9.11 (x32 Version: 1.3.9.11)
XONE:DX USB ASIO driver

==================== Restore Points  =========================

16-11-2013 23:49:24 Installed Microsoft Keyboard Layout Creator 1.4
29-11-2013 12:49:55 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-08-07 12:11 - 00001297 ____A C:\Windows\system32\Drivers\etc\hosts
255.255.255.255    easyanticheat.se    # misleading site
255.255.255.255    www.easyanticheat.se    # misleading site
255.255.255.255    easyanticheat.com    # misleading site
255.255.255.255    www.easyanticheat.com    # misleading site
255.255.255.255    easyanticheat.info    # misleading site
255.255.255.255    www.easyanticheat.info    # misleading site
255.255.255.255    easyanticheat.org    # misleading site
255.255.255.255    www.easyanticheat.org    # misleading site


==================== Scheduled Tasks (whitelisted) =============

Task: {294F8E54-7860-4578-A614-B8FD17ECF074} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {660F62E4-3C17-4A82-910B-1EFF9B1B70D4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA => C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-19] (Google Inc.)
Task: {7ECCD74C-43B0-4865-8ADE-4FB3C8DA8DBD} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe [2013-11-29] ()
Task: {7F40EC8A-40E4-448E-B1DA-DEB393915C30} - System32\Tasks\MATLAB R2013a Startup Accelerator => C:\Program Files (x86)\MATLAB\R2013a Student\bin\win32\MATLABStartupAccelerator.exe [2013-01-16] ()
Task: {BD6DCC7A-D7A5-41D4-8728-AE1B589028B4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core => C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-19] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core.job => C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA.job => C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job => C:\Program Files (x86)\MATLAB\R2013a Student\bin\win32\MATLABStartupAccelerator.exe
Task: C:\Windows\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe

==================== Loaded Modules (whitelisted) =============

2013-10-24 06:22 - 2013-10-24 06:22 - 00234792 _____ () C:\Windows\ngmsi.dll
2013-09-19 23:32 - 2013-09-19 23:32 - 01102336 _____ () C:\Program Files (x86)\MyPC Backup\x64\System.Data.SQLite.dll
2012-09-05 18:53 - 2013-07-09 12:12 - 00214016 _____ () C:\Program Files\EslWire\service\NocIPC64.dll
2012-09-24 11:10 - 2005-04-22 05:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2012-12-17 17:14 - 2012-12-17 17:14 - 00954848 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2013-11-29 12:51 - 2013-11-29 12:51 - 02603312 _____ () C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll
2013-08-15 10:35 - 2013-08-15 10:35 - 00472576 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\VistaBridgeLibrary\090c81310cca198973837e5d7ae51ac6\VistaBridgeLibrary.ni.dll
2013-09-19 23:37 - 2013-09-19 23:37 - 00012288 _____ () C:\Program Files (x86)\MyPC Backup\GetText.dll
2013-08-08 10:08 - 2013-08-07 15:57 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-11-29 12:51 - 2013-10-29 14:08 - 02869720 _____ () C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-01-08 17:02 - 2009-09-17 13:04 - 00115952 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\PSTVdsDisk.dll
2010-01-08 17:02 - 2009-09-17 13:05 - 00128240 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
2010-01-08 16:59 - 2009-10-02 13:18 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Tobias\AppData\Roaming\Dropbox\bin\libcef.dll
2009-09-11 12:08 - 2009-09-11 12:08 - 00268016 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbShared.dll
2009-09-11 12:05 - 2009-09-11 12:05 - 00058608 _____ () C:\Program Files (x86)\Dell DataSafe Online\BalloonWindow.dll
2009-09-11 12:08 - 2009-09-11 12:08 - 00095472 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbUI.dll
2009-09-11 12:10 - 2009-09-11 12:10 - 00046320 _____ () C:\Program Files (x86)\Dell DataSafe Online\de\SdbUI.resources.dll
2009-09-11 12:10 - 2009-09-11 12:10 - 00369904 _____ () C:\Program Files (x86)\Dell DataSafe Online\de\DataSafeOnline.resources.dll
2009-09-11 12:08 - 2009-09-11 12:08 - 00140528 _____ () C:\Program Files (x86)\Dell DataSafe Online\SdbShared.XmlSerializers.dll
2009-08-21 10:57 - 2009-08-21 10:57 - 00017648 _____ () C:\Program Files (x86)\Dell DataSafe Online\cpputils.dll
2009-09-11 12:10 - 2009-09-11 12:10 - 00062704 _____ () C:\Program Files (x86)\Dell DataSafe Online\de\SdbShared.resources.dll
2012-09-24 11:09 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-11-15 13:52 - 2013-11-14 12:28 - 00702416 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll
2013-11-15 13:52 - 2013-11-14 12:28 - 00099792 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll
2013-11-15 13:52 - 2013-11-14 12:29 - 04055504 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
2013-11-15 13:52 - 2013-11-14 12:29 - 00399312 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
2013-11-15 13:52 - 2013-11-14 12:28 - 01619408 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll
2013-11-15 13:53 - 2013-11-14 12:29 - 13582800 _____ () C:\Users\Tobias\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Tobias\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Tobias\Documents\.DS_Store:AFP_AfpInfo

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/29/2013 01:52:21 PM) (Source: System Restore) (User: )
Description: Unbekannter Fehler bei der Systemwiederherstellung: (Installed Microsoft Keyboard Layout Creator 1.4). Zusätzliche Informationen: 0x800703f1.

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (11/29/2013 01:22:43 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (11/29/2013 02:55:35 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
RxFilter

Error: (11/29/2013 02:55:35 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/29/2013 02:54:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SessionLauncher" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 02:52:51 PM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (11/29/2013 01:52:46 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/29/2013 01:52:10 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
RxFilter

Error: (11/29/2013 01:52:11 PM) (Source: VDS Basic Provider) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/29/2013 01:52:11 PM) (Source: VDS Basic Provider) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/29/2013 01:52:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SessionLauncher" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 01:52:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (11/29/2013 01:52:21 PM) (Source: System Restore)(User: )
Description: Installed Microsoft Keyboard Layout Creator 1.40x800703f1

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8

Error: (11/29/2013 01:42:42 PM) (Source: SideBySide)(User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service)(User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/29/2013 01:22:46 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (11/29/2013 01:22:43 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore


==================== Memory info =========================== 

Percentage of memory in use: 49%
Total physical RAM: 3959.08 MB
Available physical RAM: 2017.1 MB
Total Pagefile: 7916.34 MB
Available Pagefile: 5396.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:824.17 GB) (Free:474.91 GB) NTFS
Drive j: (AMDO USB) (Removable) (Total:7.89 GB) (Free:1.14 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E8000000)
Partition 1: (Not Active) - (Size=78 MB) - (Type=DE)
Partition 2: (Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=824 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=98 GB) - (Type=05)

========================================================
Disk: 5 (Size: 8 GB) (Disk ID: 79D6E9F6)
Partition 1: (Active) - (Size=8 GB) - (Type=0C)

==================== End Of Log ============================

T04ST3R · 29.11.2013, 16:50

Gmer:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-29 14:47:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 931,52GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Tobias\AppData\Local\Temp\fwddipoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                    fffff80003208000 45 bytes [01, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                                    fffff8000320802f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                               0000000072861a22 2 bytes [86, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                               0000000072861ad0 2 bytes [86, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                               0000000072861b08 2 bytes [86, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                               0000000072861bba 2 bytes [86, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                               0000000072861bda 2 bytes [86, 72]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                        0000000076ae1465 2 bytes [AE, 76]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                       0000000076ae14bb 2 bytes [AE, 76]
.text     ...                                                                                                                                                                   * 2
.text     C:\Program Files (x86)\Steam\Steam.exe[4056] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate                                                                            0000000076ba549c 5 bytes JMP 00000001000c0800
.text     C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                 0000000076ae1465 2 bytes [AE, 76]
.text     C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                0000000076ae14bb 2 bytes [AE, 76]
.text     ...                                                                                                                                                                   * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000076ae1465 2 bytes [AE, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         0000000076ae14bb 2 bytes [AE, 76]
.text     ...                                                                                                                                                                   * 2
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!KiUserCallbackDispatcher                                         00000000771200dc 5 bytes JMP 00000001007c7e89
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtWaitForSingleObject                                            000000007712f8bc 5 bytes JMP 00000001007dcd37
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtReadFile                                                       000000007712f8f0 5 bytes JMP 00000001007e8855
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtDeviceIoControlFile                                            000000007712f90c 5 bytes JMP 00000001007e987b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                      000000007712f928 5 bytes JMP 00000001007e8091
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                          000000007712f9e0 5 bytes JMP 00000001007de18a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                    000000007712f9f8 5 bytes JMP 00000001007dddd8
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationFile                                           000000007712fa10 5 bytes JMP 00000001007e8b03
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                        000000007712fa28 5 bytes JMP 00000001007e190f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                              000000007712fa40 5 bytes JMP 00000001007e2243
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                       000000007712fa90 5 bytes JMP 00000001007e16b4
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                  000000007712faa8 5 bytes JMP 00000001007e11de
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtWriteFileGather                                                000000007712fb0c 5 bytes JMP 00000001007e7f19
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                          000000007712fb28 5 bytes JMP 00000001007e3d91
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                      000000007712fb40 5 bytes JMP 00000001007e26e2
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryVirtualMemory                                             000000007712fbd8 5 bytes JMP 00000001007df515
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                    000000007712fc20 5 bytes JMP 00000001007e438b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                             000000007712fc38 5 bytes JMP 00000001007e848b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                               000000007712fc50 5 bytes JMP 00000001007dfac6
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                             000000007712fc80 5 bytes JMP 00000001007df791
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                               000000007712fcb0 5 bytes JMP 00000001007e56f9
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtReadFileScatter                                                000000007712fce4 5 bytes JMP 00000001007e86dd
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                   000000007712fd4c 5 bytes JMP 00000001007e239d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                       000000007712fd64 5 bytes JMP 00000001007e917f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                             000000007712fd98 5 bytes JMP 00000001007e8ecc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                    000000007712fdc8 5 bytes JMP 00000001007df9b1
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtFsControlFile                                                  000000007712fdf8 5 bytes JMP 00000001007e95ff
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                000000007712fe44 5 bytes JMP 00000001007de001
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                            000000007712fe5c 5 bytes JMP 00000001007e9079
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                      000000007712fea8 5 bytes JMP 00000001007dd368
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateEvent                                                    000000007712ff74 5 bytes JMP 00000001007dd033
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile                                     000000007712ff8c 5 bytes JMP 00000001007e89cd
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                  000000007712ffa4 5 bytes JMP 00000001007dfd9c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile                                               000000007712ffbc 5 bytes JMP 00000001007e977f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                000000007712ffec 5 bytes JMP 00000001007e40ca
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                   0000000077130004 5 bytes JMP 00000001007e3e81
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQuerySection                                                   0000000077130050 5 bytes JMP 00000001007df8a7
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                     00000000771300b4 5 bytes JMP 00000001007e9fe2
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtWaitForMultipleObjects                                         0000000077130148 5 bytes JMP 00000001007dd8da
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationObject                                           0000000077130164 5 bytes JMP 00000001007ddcb5
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCancelIoFile                                                   000000007713017c 5 bytes JMP 00000001007ea29d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                    00000000771301c4 5 bytes JMP 00000001007e090a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtAreMappedFilesTheSame                                          0000000077130580 5 bytes JMP 00000001007df40c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCancelIoFileEx                                                 00000000771305b8 5 bytes JMP 00000001007ea19b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCompactKeys                                                    0000000077130630 5 bytes JMP 00000001007e294a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCompressKey                                                    0000000077130678 5 bytes JMP 00000001007e2861
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateMailslotFile                                             0000000077130784 5 bytes JMP 00000001007e9e4f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                   000000007713079c 5 bytes JMP 00000001007dd572
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateNamedPipeFile                                            00000000771307b4 5 bytes JMP 00000001007e9c20
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreatePagingFile                                               00000000771307cc 5 bytes JMP 00000001007e9ae3
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                  0000000077130814 5 bytes JMP 00000001007e4236
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateSemaphore                                                0000000077130874 5 bytes JMP 00000001007dd22b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                              000000007713091c 5 bytes JMP 00000001007e3fb9
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                     00000000771309e4 5 bytes JMP 00000001007e99fb
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                      00000000771309fc 5 bytes JMP 00000001007e25f9
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                 0000000077130a44 5 bytes JMP 00000001007e24f7
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtExtendSection                                                  0000000077130b1c 5 bytes JMP 00000001007dfc9a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                       0000000077130b80 5 bytes JMP 00000001007e215a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey                                                        0000000077130e0c 5 bytes JMP 00000001007e2079
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey2                                                       0000000077130e24 5 bytes JMP 00000001007e1f7e
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtLoadKeyEx                                                      0000000077130e3c 5 bytes JMP 00000001007e1e62
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtLockFile                                                       0000000077130e54 5 bytes JMP 00000001007e9459
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtLockRegistryKey                                                0000000077130e88 5 bytes JMP 00000001007e1d79
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtMakeTemporaryObject                                            0000000077130ed8 5 bytes JMP 00000001007ddf18
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeDirectoryFile                                      0000000077130f58 5 bytes JMP 00000001007e92df
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                0000000077130f70 5 bytes JMP 00000001007e1be5
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                       0000000077130f88 5 bytes JMP 00000001007e1a24
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                      0000000077131018 5 bytes JMP 00000001007e17f4
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenMutant                                                     0000000077131078 5 bytes JMP 00000001007dd46d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtOpenSemaphore                                                  00000000771310f0 5 bytes JMP 00000001007dd126
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryEaFile                                                    0000000077131324 5 bytes JMP 00000001007e8d3f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                        000000007713133c 5 bytes JMP 00000001007e8c39
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                          000000007713147c 5 bytes JMP 00000001007e156f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryOpenSubKeys                                               00000000771314ac 5 bytes JMP 00000001007e1463
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryOpenSubKeysEx                                             00000000771314c4 5 bytes JMP 00000001007e1337
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQueryQuotaInformationFile                                      00000000771314f8 5 bytes JMP 00000001007e7d9f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                            0000000077131528 5 bytes JMP 00000001007dd79a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                      0000000077131718 5 bytes JMP 00000001007e10dc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtReplaceKey                                                     0000000077131748 5 bytes JMP 00000001007e0fe7
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtRestoreKey                                                     00000000771317e0 5 bytes JMP 00000001007e0eca
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSaveKey                                                        0000000077131874 5 bytes JMP 00000001007e0dc7
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSaveKeyEx                                                      000000007713188c 5 bytes JMP 00000001007e0caa
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSaveMergedKeys                                                 00000000771318a4 5 bytes JMP 00000001007e0b87
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetEaFile                                                      00000000771319c0 5 bytes JMP 00000001007e85c1
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                              0000000077131a58 5 bytes JMP 00000001007e0a64
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetQuotaInformationFile                                        0000000077131b84 5 bytes JMP 00000001007e7c83
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                              0000000077131b9c 5 bytes JMP 00000001007dd691
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSetVolumeInformationFile                                       0000000077131c9c 5 bytes JMP 00000001007e8355
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtSignalAndWaitForSingleObject                                   0000000077131ce8 5 bytes JMP 00000001007ddb83
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtTranslateFilePath                                              0000000077131e24 5 bytes JMP 00000001007e7b6e
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKey                                                      0000000077131e70 5 bytes JMP 00000001007e0822
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKey2                                                     0000000077131e88 5 bytes JMP 00000001007e0720
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKeyEx                                                    0000000077131ea0 5 bytes JMP 00000001007e061e
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!NtUnlockFile                                                     0000000077131eb8 5 bytes JMP 00000001007e8209
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!RtlFreeHeap                                                      000000007713dfa5 2 bytes JMP 00000001007e3587
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!RtlFreeHeap + 3                                                  000000007713dfa8 2 bytes [6A, 89]
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!LdrGetDllHandle                                                  000000007713fd37 5 bytes JMP 00000001007e4a55
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!LdrGetProcedureAddressEx                                         000000007714020b 5 bytes JMP 00000001007e4d23
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                       000000007714c4dd 5 bytes JMP 00000001007ea42a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                     0000000077151287 5 bytes JMP 00000001007ea399
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\SysWOW64\ntdll.dll!LdrShutdownThread                                                0000000077167d7d 5 bytes JMP 00000001007e4480
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!SetThreadPriority + 24                                        0000000076333273 5 bytes JMP 00000001007e3638
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!BaseThreadInitThunk                                           0000000076333358 5 bytes JMP 00000001007e491c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                   00000000763379b0 5 bytes JMP 00000001007e35fc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!CreateActCtxW                                                 00000000763391e7 5 bytes JMP 00000001007f3b59
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!QueryActCtxW                                                  000000007633cada 5 bytes JMP 00000001007f3c1a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                        0000000076343b93 5 bytes JMP 00000001007e613f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!GetConsoleTitleW                                              000000007634a936 5 bytes JMP 00000001007e4571
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!GetConsoleTitleA                                              00000000763d67bb 5 bytes JMP 00000001007e466c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!SetConsoleTitleA                                              00000000763d67d8 5 bytes JMP 00000001007e483c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\kernel32.dll!SetConsoleTitleW                                              00000000763d6851 5 bytes JMP 00000001007e477d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumDependentServicesW                                        0000000076be1e3a 5 bytes JMP 00000001007f6410
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!StartServiceW                                                 0000000076be7914 5 bytes JMP 00000001007f4bad
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceStatusEx                                          0000000076be792c 5 bytes JMP 00000001007f554f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!StartServiceCtrlDispatcherW                                   0000000076bea905 5 bytes JMP 00000001007f4d5d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!RegisterServiceCtrlHandlerW                                   0000000076bea91d 5 bytes JMP 00000001007f53ab
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!RegisterServiceCtrlHandlerExW                                 0000000076bea94d 5 bytes JMP 00000001007f5201
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumServicesStatusExW                                         0000000076beb406 5 bytes JMP 00000001007f615c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceConfigW                                           0000000076beb4d7 5 bytes JMP 00000001007f5953
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!SetServiceStatus                                              0000000076bec746 5 bytes JMP 00000001007f4fb9
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!OpenServiceW                                                  0000000076bec9ec 5 bytes JMP 00000001007f5b03
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!OpenSCManagerW                                                0000000076beca04 5 bytes JMP 00000001007f5ccc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceStatus                                            0000000076bf2a06 5 bytes JMP 00000001007f562a
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!OpenSCManagerA                                                0000000076bf2b58 5 bytes JMP 00000001007f5d64
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!OpenServiceA                                                  0000000076bf2b70 5 bytes JMP 00000001007f5bdb
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!CloseServiceHandle                                            0000000076bf361c 5 bytes JMP 00000001007f6a76
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!CreateServiceW                                                0000000076c070c4 5 bytes JMP 00000001007f6661
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!ControlService                                                0000000076c070dc 5 bytes JMP 00000001007f69a1
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!DeleteService                                                 0000000076c070f4 5 bytes JMP 00000001007f65cc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!GetServiceKeyNameW                                            0000000076c07897 5 bytes JMP 00000001007f5fac
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!GetServiceDisplayNameW                                        0000000076c07953 5 bytes JMP 00000001007f5dfc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceConfigA                                           0000000076c099e7 5 bytes JMP 00000001007f5a2b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumServicesStatusExA                                         0000000076c0a37a 5 bytes JMP 00000001007f620c
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!ChangeServiceConfigA                                          0000000076c231f4 5 bytes JMP 00000001007f68b7
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!ChangeServiceConfigW                                          0000000076c23204 5 bytes JMP 00000001007f67cd
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!CreateServiceA                                                0000000076c23264 5 bytes JMP 00000001007f6717
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceConfig2A                                          0000000076c234f5 5 bytes JMP 00000001007f5878
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceConfig2W                                          0000000076c23505 5 bytes JMP 00000001007f579d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!QueryServiceObjectSecurity                                    0000000076c23515 5 bytes JMP 00000001007f56fc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!RegisterServiceCtrlHandlerA                                   0000000076c235cf 5 bytes JMP 00000001007f547d
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!RegisterServiceCtrlHandlerExA                                 0000000076c235df 5 bytes JMP 00000001007f52d6
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!SetServiceObjectSecurity                                      0000000076c2363f 5 bytes JMP 00000001007f508e
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!StartServiceA                                                 0000000076c2364f 5 bytes JMP 00000001007f4c85
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!StartServiceCtrlDispatcherA                                   0000000076c2365f 5 bytes JMP 00000001007f4e8b
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!GetServiceKeyNameA                                            0000000076c41d74 5 bytes JMP 00000001007f6084
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!GetServiceDisplayNameA                                        0000000076c41e11 5 bytes JMP 00000001007f5ed4
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumServicesStatusA                                           0000000076c42201 5 bytes JMP 00000001007f6366
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumDependentServicesA                                        0000000076c422e4 5 bytes JMP 00000001007f64ee
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!SetServiceBits                                                0000000076c423cb 5 bytes JMP 00000001007f5129
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\advapi32.dll!EnumServicesStatusW                                           0000000076c42401 5 bytes JMP 00000001007f62bc
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                         000000007672ea09 5 bytes JMP 00000001007d3b54
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                            00000000767321e1 5 bytes JMP 00000001007d466f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                 00000000767554ad 5 bytes JMP 00000001007d480f
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                 0000000076769d0b 5 bytes JMP 00000001007d4bf0
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                               0000000076769d4e 5 bytes JMP 00000001007d48f6
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                              00000000767aeacf 5 bytes JMP 00000001007d3bc2
.text     C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe[4420] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                            00000000767e340b 5 bytes JMP 00000001007d5056
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3144] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate                                                        0000000076ba549c 5 bytes JMP 0000000100110800
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                              0000000076ae1465 2 bytes [AE, 76]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                             0000000076ae14bb 2 bytes [AE, 76]
.text     ...                                                                                                                                                                   * 2

---- Threads - GMER 2.1 ----

Thread    C:\Windows\system32\WUDFHost.exe [3080:3468]                                                                                                                          000007fef7ea24a0
---- Processes - GMER 2.1 ----

Library   C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\__Xenocode\x86\vmx.dll (*** suspicious ***) @ C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\spoon-sandbox.exe [4420]  0000000010000000

---- EOF - GMER 2.1 ----

schrauber · 30.11.2013, 16:50

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

T04ST3R · 01.12.2013, 13:33

MBAM:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.01.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Tobias :: TOASTER [Administrator]

01.12.2013 11:52:43
mbam-log-2013-12-01 (11-52-43).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217778
Laufzeit: 6 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 2
C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe (PUP.Optional.OptimizerPro) -> 3488 -> Löschen bei Neustart.
C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe (PUP.Optional.OptimizerPro) -> 3344 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 10
HKLM\SYSTEM\CurrentControlSet\Services\70e6ca8c (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1 (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{1ad7fd01-f45b-4863-a047-8b2a3735b829} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{8268d42d-a421-47ad-818b-99dea22a0d06} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{b2ddc4fa-7d73-4d8c-879b-1fd079edd83a} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1AD7FD01-F45B-4863-A047-8B2A3735B829} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9201ddd0-5a36-43f1-a528-0e4f3ea75ed0} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\OPTIMIZER PRO (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Daten: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Optimizer Pro|AdsBuyNowURL (PUP.Optional.OptimizerPro.A) -> Daten: hxxp://domore.pcutilitiespro.revenuewire.net/driverpro/register?121000713-DE-033_E1081B84-1144-DF20-882D-96DA8D428B0D -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 6
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.OptimizerPro.A) -> Bösartig: (c:\progra~2\optimi~1\optpro~1.dll) Gut: () -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&q={searchTerms}&installDate=29/11/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 4
C:\Program Files (x86)\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Löschen bei Neustart.
C:\Users\Tobias\Documents\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2 (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 41
C:\Program Files (x86)\Optimizer Pro\OptProCrash.exe (PUP.Optional.OptimizerPro) -> Löschen bei Neustart.
C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe (PUP.Optional.OptimizerPro) -> Löschen bei Neustart.
C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe (PUP.Optional.OptimizerPro) -> Löschen bei Neustart.
C:\Users\Tobias\AppData\Local\Temp\Temporary files\parent.txt (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tobias\AppData\Local\Temp\Temporary files\software\Installer.exe (PUP.Optional.Linkury.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tobias\AppData\Local\Temp\Temporary files\software\OptimizerPro.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.chm (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\CookiesException.txt (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\file_id.diz (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\German.ini (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\HomePage.url (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptProCrash.dll (PUP.Optional.OptimizerPro.A) -> Löschen bei Neustart.
C:\Program Files (x86)\Optimizer Pro\OptProCrash_x64.dll (PUP.Optional.OptimizerPro.A) -> Löschen bei Neustart.
C:\Program Files (x86)\Optimizer Pro\OptProGuard.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptProSchedule.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\OptProUninstaller.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\scan.gif (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\sqlite3.dll (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\StartupList.txt (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\unins000.dat (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\unins000.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Optimizer Pro\unins000.msg (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Tobias\Documents\Optimizer Pro\CookiesException.txt (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Hilfe.lnk (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Nach Updates suchen.lnk (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro entfernen.lnk (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro im Internet.lnk (PUP.Optional.OptimizerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\135.crx (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\135.dat (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\135.dll (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\135.xpi (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\crx.db (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\ReMarkit_up.exe (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\sqlite3.dll (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\Uninstall.exe (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Re-markit\xpi.db (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\WINDOWS\Tasks\Re-markit Update.job (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

AdwCleaner

Code:

ATTFilter

# AdwCleaner v3.013 - Bericht erstellt am 01/12/2013 um 13:12:45
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Tobias - TOASTER
# Gestartet von : C:\Users\Tobias\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : BackupStack

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\optimizer pro
Ordner Gelöscht : C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
Ordner Gelöscht : C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\searchplugins\Web Search.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v20.0.1 (de)

[ Datei : C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\prefs.js ]

Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=hp&installDate=29/11/2013");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=Tuguu&co=DE&userid=7f6ceee4-e39a-61b8-3e73-77936153de77&searchtype=ds&installDate=29/11/2013&q=");

-\\ Google Chrome v

[ Datei : C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : homepage
Gelöscht : urls_to_restore_on_startup

*************************

AdwCleaner[R0].txt - [4475 octets] - [01/12/2013 13:11:20]
AdwCleaner[S0].txt - [3923 octets] - [01/12/2013 13:12:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3983 octets] ##########

JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Tobias on 01.12.2013 at 13:19:39,57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Tobias\AppData\Roaming\mozilla\firefox\profiles\8wza78sq.default\extensions\staged
Emptied folder: C:\Users\Tobias\AppData\Roaming\mozilla\firefox\profiles\8wza78sq.default\minidumps [8 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Tobias\appdata\local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.12.2013 at 13:23:41,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-12-2013
Ran by Tobias (administrator) on TOASTER on 01-12-2013 13:26:36
Running from C:\Users\Tobias\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\WINDOWS\System32\atiesrxx.exe
(AMD) C:\WINDOWS\System32\atieclxx.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(Aventail Corporation) C:\WINDOWS\System32\ngvpnmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\WINDOWS\SysWOW64\PnkBstrA.exe
(SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Spotify Ltd) C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Dropbox, Inc.) C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
() C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Code Systems Corporation) C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-07] (Realtek Semiconductor)
HKLM\...\Run: [RunDLLEntry_THXCfg] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [RunDLLEntry_EptMon] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\EptMon64.dll,RunDLLEntry EptMon64
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-06-26] (Sonic Solutions)
HKLM-x32\...\Winlogon: [Userinit] C:\Windows\sysWOW64\userinit.exe [26624 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-19] (Google Inc.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-07] (Spotify Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2009-07-17] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-09-11] ()
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdReg] - C:\WINDOWS\Updreg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
AppInit_DLLs:   [ ] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Console.lnk
ShortcutTarget: Spoon.net Console.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Console.exe (Code Systems Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Sandbox Manager 3.33.lnk
ShortcutTarget: Spoon.net Sandbox Manager 3.33.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox-Native.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {BD761245-15E0-4655-AE50-64D5C2D15945} URL = 
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @idsoftware.com/QuakeLive - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @spoon.net/Spoon Plugin 3.33 - C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\npMozillaSpoonPlugin.dll (Code Systems Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: qlping.com/qlping - C:\Users\Tobias\AppData\Local\qlPing\0.0.1.0\npqlping.dll (qlping)
FF Extension: DownloadHelper - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Adblock Plus - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF HKCU\...\Firefox\Extensions: [{5ce3e0cb-aa83-45cb-a7da-a2684f05b8f3}] - C:\Program Files (x86)\Re-markit\135.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Google) - https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultSuggestURL: (Google) - https://www.google.com/complete/search?q={searchTerms}
CHR Extension: (Adblock Plus) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Re-markit) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel\1.135_0
CHR Extension: (SciLor's Grooveshark(tm) Unlocker) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\feegenemlbjkbnfpgdmjddbeiecdbpob\0.3.3_0
CHR Extension: (Google Wallet) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR StartMenuInternet: Google Chrome - C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation)
R2 NgVpnMgr; C:\Windows\system32\ngvpnmgr.exe [543016 2013-10-24] (Aventail Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-16] ()
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation)
S2 SessionLauncher; c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-16] (DT Soft Ltd)
R0 ESLWireAC; C:\Windows\System32\drivers\ESLWireACD.sys [183312 2013-08-04] (<Turtle Entertainment>)
S3 NgFilter; C:\Windows\System32\DRIVERS\ngfilter.sys [26184 2013-10-23] (Aventail Corporation)
R3 NgLog; C:\Windows\System32\DRIVERS\nglog.sys [31304 2013-10-23] (Aventail Corporation)
R3 NgVpn; C:\Windows\System32\DRIVERS\ngvpn.sys [103496 2013-10-23] (Aventail Corporation)
R3 NgWfp; C:\Windows\System32\DRIVERS\ngwfp.sys [28744 2013-10-23] (Aventail Corporation)
S1 RxFilter; C:\Windows\SysWow64\DRIVERS\RxFilter.sys [65520 2009-06-26] (Sonic Solutions)
S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)
S3 XONE_DX; C:\Windows\System32\Drivers\XONE_DX.sys [398400 2011-08-10] (Ploytec GmbH)
S3 XONE_DXM; C:\Windows\System32\drivers\XONE_DXM.sys [31296 2011-08-10] (Ploytec GmbH)
S3 XONE_DX_WDM; C:\Windows\System32\drivers\XONE_DXW.sys [50240 2011-08-10] (Ploytec GmbH)
S3 ESEADriver2; \??\C:\Users\Tobias\AppData\Local\Temp\ESEADriver2.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-01 13:25 - 2013-12-01 13:25 - 01959184 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-12-01 13:23 - 2013-12-01 13:23 - 00001040 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-12-01 13:19 - 2013-12-01 13:19 - 00000000 ____D C:\Windows\ERUNT
2013-12-01 13:16 - 2013-12-01 13:16 - 00004079 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-12-01 13:10 - 2013-12-01 13:12 - 00000000 ____D C:\AdwCleaner
2013-12-01 13:09 - 2013-12-01 13:11 - 00000494 _____ C:\Users\Tobias\Desktop\adwanleitung.txt
2013-12-01 12:04 - 2013-12-01 12:04 - 00009886 _____ C:\Windows\PFRO.log
2013-12-01 11:49 - 2013-12-01 11:49 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-01 11:49 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-01 11:48 - 2013-12-01 11:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Tobias\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01091882 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01034531 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-11-29 16:14 - 2013-11-29 16:14 - 00018769 _____ C:\Users\Tobias\Downloads\Logfiles.7z
2013-11-29 15:28 - 2013-11-29 15:28 - 00018769 _____ C:\Users\Tobias\Desktop\Logfiles.7z
2013-11-29 15:27 - 2013-11-29 15:27 - 01110476 _____ C:\Users\Tobias\Downloads\7z920.exe
2013-11-29 15:27 - 2013-11-29 15:27 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-11-29 15:19 - 2013-11-29 15:20 - 00037235 _____ C:\Users\Tobias\Desktop\Addition.txt
2013-11-29 15:17 - 2013-12-01 13:26 - 00016295 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.txt
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.txt
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-12-01 13:14 - 00000336 _____ C:\Windows\setupact.log
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-13 17:28 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 17:28 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 17:28 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 17:28 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 17:28 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 17:28 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 17:28 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 17:28 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 17:28 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 17:28 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 14:50 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:38 - 2013-11-07 19:39 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-25 15:25 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-04 19:20 - 2013-09-22 19:12 - 00064794 _____ C:\Users\Tobias\Documents\WarthunderPS3controllerV2.blk
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 19:54 - 2013-11-02 23:31 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 19:54 - 2013-11-02 23:30 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

==================== One Month Modified Files and Folders =======

2013-12-01 13:27 - 2013-11-29 15:17 - 00016295 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-12-01 13:25 - 2013-12-01 13:25 - 01959184 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-12-01 13:24 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-01 13:24 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-01 13:23 - 2013-12-01 13:23 - 00001040 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-12-01 13:21 - 2009-07-14 18:58 - 00699416 _____ C:\Windows\system32\perfh007.dat
2013-12-01 13:21 - 2009-07-14 18:58 - 00149556 _____ C:\Windows\system32\perfc007.dat
2013-12-01 13:21 - 2009-07-14 06:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-01 13:19 - 2013-12-01 13:19 - 00000000 ____D C:\Windows\ERUNT
2013-12-01 13:19 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Dropbox
2013-12-01 13:16 - 2013-12-01 13:16 - 00004079 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-12-01 13:16 - 2012-10-11 17:18 - 00000000 ___RD C:\Users\Tobias\Dropbox
2013-12-01 13:15 - 2012-07-09 22:35 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-01 13:14 - 2013-11-29 13:21 - 00000336 _____ C:\Windows\setupact.log
2013-12-01 13:14 - 2013-05-08 19:22 - 00000604 _____ C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2013-12-01 13:14 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-01 13:13 - 2009-07-14 06:10 - 01179569 _____ C:\Windows\WindowsUpdate.log
2013-12-01 13:12 - 2013-12-01 13:10 - 00000000 ____D C:\AdwCleaner
2013-12-01 13:12 - 2012-07-09 21:26 - 00000000 ___RD C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-01 13:11 - 2013-12-01 13:09 - 00000494 _____ C:\Users\Tobias\Desktop\adwanleitung.txt
2013-12-01 12:55 - 2012-07-19 22:55 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA.job
2013-12-01 12:04 - 2013-12-01 12:04 - 00009886 _____ C:\Windows\PFRO.log
2013-12-01 11:49 - 2013-12-01 11:49 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-01 11:48 - 2013-12-01 11:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Tobias\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01091882 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01034531 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-11-30 00:30 - 2012-07-19 22:55 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core.job
2013-11-29 16:14 - 2013-11-29 16:14 - 00018769 _____ C:\Users\Tobias\Downloads\Logfiles.7z
2013-11-29 15:28 - 2013-11-29 15:28 - 00018769 _____ C:\Users\Tobias\Desktop\Logfiles.7z
2013-11-29 15:27 - 2013-11-29 15:27 - 01110476 _____ C:\Users\Tobias\Downloads\7z920.exe
2013-11-29 15:27 - 2013-11-29 15:27 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-11-29 15:20 - 2013-11-29 15:19 - 00037235 _____ C:\Users\Tobias\Desktop\Addition.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.txt
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.txt
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:31 - 2012-07-09 21:26 - 00000000 ____D C:\Users\Tobias
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-29 12:56 - 2012-08-16 13:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\DAEMON Tools Lite
2013-11-29 12:55 - 2010-01-09 01:40 - 00000000 ____D C:\Windows\Panther
2013-11-29 12:51 - 2012-08-20 11:38 - 00000000 ____D C:\Program Files\CCleaner
2013-11-28 21:50 - 2012-07-19 22:55 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA
2013-11-28 21:50 - 2012-07-19 22:55 - 00003700 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core
2013-11-28 17:34 - 2013-05-08 19:25 - 00000000 ____D C:\Users\Tobias\Documents\MATLAB
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\ProgramData\Aventail
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\Program Files\Aventail Connect
2013-11-25 15:25 - 2013-11-07 18:37 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-25 14:11 - 2013-08-08 10:10 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 18:11 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-22 17:54 - 2012-09-25 14:53 - 00001870 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-11-21 23:18 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-20 22:04 - 2012-07-10 11:36 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\TS3Client
2013-11-19 17:40 - 2013-07-03 15:10 - 00000000 ____D C:\Users\Tobias\Documents\Schule
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-15 20:59 - 2013-05-11 15:49 - 00015364 ____H C:\Users\Tobias\.DS_Store
2013-11-14 17:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 18:20 - 2012-07-09 21:33 - 00001427 _____ C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-12 18:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-08 11:13 - 2013-02-13 23:15 - 00000000 ____D C:\Users\Tobias\Documents\Playstation Gems
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:39 - 2013-11-07 19:38 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-06 21:54 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-02 23:31 - 2013-11-02 19:54 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 23:30 - 2013-11-02 19:54 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

Files to move or delete:
====================
C:\Users\Tobias\AppData\Roaming\Camdata.ini
C:\Users\Tobias\AppData\Roaming\CamLayout.ini
C:\Users\Tobias\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\avgnt.exe
C:\Users\Tobias\AppData\Local\Temp\BackupSetup.exe
C:\Users\Tobias\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 00:41

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 02.12.2013, 10:26

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

T04ST3R · 02.12.2013, 14:50

Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f9b908abd5a9464abf3885d8c0d4cf3d
# engine=16102
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-02 01:29:52
# local_time=2013-12-02 02:29:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 5134 156662297 0 0
# compatibility_mode=5893 16776574 100 94 10211407 137620842 0 0
# scanned=10374
# found=0
# cleaned=0
# scan_time=327

Checkup:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.76  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 33  
 Java 7 Update 7  
 Visual Studio Extensions for Windows Library for JavaScript 
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
  Adobe Flash Player 11.4.402.265 Flash Player out of Date!  
 Adobe Reader 10.1.4 Adobe Reader out of Date!  
 Mozilla Firefox 20.0.1 Firefox out of Date!  
 Google Chrome 31.0.1650.48  
 Google Chrome 31.0.1650.57  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-12-2013
Ran by Tobias (administrator) on TOASTER on 02-12-2013 14:44:44
Running from C:\Users\Tobias\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\WINDOWS\System32\atiesrxx.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
(Aventail Corporation) C:\WINDOWS\System32\ngvpnmgr.exe
(AMD) C:\WINDOWS\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
() C:\WINDOWS\SysWOW64\PnkBstrA.exe
(SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify Ltd) C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
() C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Code Systems Corporation) C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe
(Spotify Ltd) C:\Users\Tobias\AppData\Roaming\Spotify\spotify.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-07] (Realtek Semiconductor)
HKLM\...\Run: [RunDLLEntry_THXCfg] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [RunDLLEntry_EptMon] - C:\Windows\system32\RunDLL32.exe C:\Windows\system32\EptMon64.dll,RunDLLEntry EptMon64
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-06-26] (Sonic Solutions)
HKLM-x32\...\Winlogon: [Userinit] C:\Windows\sysWOW64\userinit.exe [26624 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Tobias\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-19] (Google Inc.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Tobias\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-07] (Spotify Ltd)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-10-02] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] - C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2009-07-17] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1779952 2009-09-11] ()
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdReg] - C:\WINDOWS\Updreg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
AppInit_DLLs:   [ ] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Tobias\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Console.lnk
ShortcutTarget: Spoon.net Console.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Console.exe (Code Systems Corporation)
Startup: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spoon.net Sandbox Manager 3.33.lnk
ShortcutTarget: Spoon.net Sandbox Manager 3.33.lnk -> C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\Spoon-Sandbox-Native.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {BD761245-15E0-4655-AE50-64D5C2D15945} URL = 
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @idsoftware.com/QuakeLive - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @spoon.net/Spoon Plugin 3.33 - C:\Users\Tobias\AppData\Local\Spoon\3.33.6.119\npMozillaSpoonPlugin.dll (Code Systems Corporation)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Tobias\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: qlping.com/qlping - C:\Users\Tobias\AppData\Local\qlPing\0.0.1.0\npqlping.dll (qlping)
FF Extension: DownloadHelper - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Adblock Plus - C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\8wza78sq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF HKCU\...\Firefox\Extensions: [{5ce3e0cb-aa83-45cb-a7da-a2684f05b8f3}] - C:\Program Files (x86)\Re-markit\135.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Google) - https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultSuggestURL: (Google) - https://www.google.com/complete/search?q={searchTerms}
CHR Extension: (Adblock Plus) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Re-markit) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel\1.135_0
CHR Extension: (SciLor's Grooveshark(tm) Unlocker) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\feegenemlbjkbnfpgdmjddbeiecdbpob\0.3.3_0
CHR Extension: (Google Wallet) - C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR StartMenuInternet: Google Chrome - C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe [139776 2012-07-25] (Microsoft Corporation)
R2 NgVpnMgr; C:\Windows\system32\ngvpnmgr.exe [543016 2013-10-24] (Aventail Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-16] ()
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [126976 2012-07-25] (Microsoft Corporation)
S2 SessionLauncher; c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-16] (DT Soft Ltd)
R0 ESLWireAC; C:\Windows\System32\drivers\ESLWireACD.sys [183312 2013-08-04] (<Turtle Entertainment>)
S3 NgFilter; C:\Windows\System32\DRIVERS\ngfilter.sys [26184 2013-10-23] (Aventail Corporation)
R3 NgLog; C:\Windows\System32\DRIVERS\nglog.sys [31304 2013-10-23] (Aventail Corporation)
R3 NgVpn; C:\Windows\System32\DRIVERS\ngvpn.sys [103496 2013-10-23] (Aventail Corporation)
R3 NgWfp; C:\Windows\System32\DRIVERS\ngwfp.sys [28744 2013-10-23] (Aventail Corporation)
S1 RxFilter; C:\Windows\SysWow64\DRIVERS\RxFilter.sys [65520 2009-06-26] (Sonic Solutions)
S3 VSPerfDrv110; C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys [70264 2012-07-26] (Microsoft Corporation)
S3 XONE_DX; C:\Windows\System32\Drivers\XONE_DX.sys [398400 2011-08-10] (Ploytec GmbH)
S3 XONE_DXM; C:\Windows\System32\drivers\XONE_DXM.sys [31296 2011-08-10] (Ploytec GmbH)
S3 XONE_DX_WDM; C:\Windows\System32\drivers\XONE_DXW.sys [50240 2011-08-10] (Ploytec GmbH)
S3 ESEADriver2; \??\C:\Users\Tobias\AppData\Local\Temp\ESEADriver2.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-02 14:40 - 2013-12-02 14:40 - 00001248 _____ C:\Users\Tobias\Desktop\checkup.txt
2013-12-02 14:21 - 2013-12-02 14:21 - 02347384 _____ (ESET) C:\Users\Tobias\Downloads\esetsmartinstaller_enu (1).exe
2013-12-02 14:21 - 2013-12-02 14:21 - 00000000 _____ C:\Users\Tobias\Desktop\anleitung.txt
2013-12-02 14:20 - 2013-12-02 14:20 - 00891184 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-12-02 14:19 - 2013-12-02 14:19 - 02347384 _____ (ESET) C:\Users\Tobias\Downloads\esetsmartinstaller_enu.exe
2013-12-01 22:26 - 2013-11-28 12:02 - 00000000 ____D C:\Users\Tobias\Downloads\Schattenbilder in 3D
2013-12-01 22:24 - 2013-12-01 22:25 - 02737042 _____ C:\Users\Tobias\Downloads\Schattenbilder in 3D.zip
2013-12-01 13:25 - 2013-12-01 13:25 - 01959184 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-12-01 13:23 - 2013-12-01 13:23 - 00001040 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-12-01 13:19 - 2013-12-01 13:19 - 00000000 ____D C:\Windows\ERUNT
2013-12-01 13:16 - 2013-12-01 13:16 - 00004079 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-12-01 13:10 - 2013-12-01 13:12 - 00000000 ____D C:\AdwCleaner
2013-12-01 13:09 - 2013-12-01 13:11 - 00000494 _____ C:\Users\Tobias\Desktop\adwanleitung.txt
2013-12-01 12:04 - 2013-12-01 12:04 - 00009886 _____ C:\Windows\PFRO.log
2013-12-01 11:49 - 2013-12-01 11:49 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-01 11:49 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-01 11:48 - 2013-12-01 11:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Tobias\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01091882 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01034531 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-11-29 16:14 - 2013-11-29 16:14 - 00018769 _____ C:\Users\Tobias\Downloads\Logfiles.7z
2013-11-29 15:28 - 2013-11-29 15:28 - 00018769 _____ C:\Users\Tobias\Desktop\Logfiles.7z
2013-11-29 15:27 - 2013-11-29 15:27 - 01110476 _____ C:\Users\Tobias\Downloads\7z920.exe
2013-11-29 15:27 - 2013-11-29 15:27 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-11-29 15:19 - 2013-11-29 15:20 - 00037235 _____ C:\Users\Tobias\Desktop\Addition.txt
2013-11-29 15:17 - 2013-12-02 14:44 - 00016646 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.txt
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.txt
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-12-02 13:59 - 00000392 _____ C:\Windows\setupact.log
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-13 17:28 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 17:28 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 17:28 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 17:28 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 17:28 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 17:28 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 17:28 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 17:28 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 17:28 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 17:28 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 17:28 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 17:28 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 17:28 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 17:28 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 17:28 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 17:28 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 17:28 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 14:50 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:38 - 2013-11-07 19:39 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-25 15:25 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-04 19:20 - 2013-09-22 19:12 - 00064794 _____ C:\Users\Tobias\Documents\WarthunderPS3controllerV2.blk
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 19:54 - 2013-11-02 23:31 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 19:54 - 2013-11-02 23:30 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

==================== One Month Modified Files and Folders =======

2013-12-02 14:45 - 2013-11-29 15:17 - 00016646 _____ C:\Users\Tobias\Desktop\FRST.txt
2013-12-02 14:42 - 2013-02-08 15:06 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Spotify
2013-12-02 14:40 - 2013-12-02 14:40 - 00001248 _____ C:\Users\Tobias\Desktop\checkup.txt
2013-12-02 14:22 - 2012-10-11 17:18 - 00000000 ___RD C:\Users\Tobias\Dropbox
2013-12-02 14:22 - 2012-07-09 22:35 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-02 14:22 - 2009-07-14 18:58 - 00699416 _____ C:\Windows\system32\perfh007.dat
2013-12-02 14:22 - 2009-07-14 18:58 - 00149556 _____ C:\Windows\system32\perfc007.dat
2013-12-02 14:22 - 2009-07-14 06:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-02 14:21 - 2013-12-02 14:21 - 02347384 _____ (ESET) C:\Users\Tobias\Downloads\esetsmartinstaller_enu (1).exe
2013-12-02 14:21 - 2013-12-02 14:21 - 00000000 _____ C:\Users\Tobias\Desktop\anleitung.txt
2013-12-02 14:20 - 2013-12-02 14:20 - 00891184 _____ C:\Users\Tobias\Desktop\SecurityCheck.exe
2013-12-02 14:19 - 2013-12-02 14:19 - 02347384 _____ (ESET) C:\Users\Tobias\Downloads\esetsmartinstaller_enu.exe
2013-12-02 14:08 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-02 14:08 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-02 14:05 - 2009-07-14 06:10 - 01199780 _____ C:\Windows\WindowsUpdate.log
2013-12-02 14:04 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Dropbox
2013-12-02 13:59 - 2013-11-29 13:21 - 00000392 _____ C:\Windows\setupact.log
2013-12-02 13:59 - 2013-05-08 19:22 - 00000604 _____ C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2013-12-02 13:59 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-01 23:10 - 2013-08-13 20:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-01 22:58 - 2013-05-08 19:25 - 00000000 ____D C:\Users\Tobias\Documents\MATLAB
2013-12-01 22:55 - 2012-07-19 22:55 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA.job
2013-12-01 22:25 - 2013-12-01 22:24 - 02737042 _____ C:\Users\Tobias\Downloads\Schattenbilder in 3D.zip
2013-12-01 21:55 - 2012-07-19 22:55 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core.job
2013-12-01 16:14 - 2013-02-08 15:06 - 00000000 ____D C:\Users\Tobias\AppData\Local\Spotify
2013-12-01 13:25 - 2013-12-01 13:25 - 01959184 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe
2013-12-01 13:23 - 2013-12-01 13:23 - 00001040 _____ C:\Users\Tobias\Desktop\JRT.txt
2013-12-01 13:19 - 2013-12-01 13:19 - 00000000 ____D C:\Windows\ERUNT
2013-12-01 13:16 - 2013-12-01 13:16 - 00004079 _____ C:\Users\Tobias\Desktop\AdwCleaner[S0].txt
2013-12-01 13:12 - 2013-12-01 13:10 - 00000000 ____D C:\AdwCleaner
2013-12-01 13:12 - 2012-07-09 21:26 - 00000000 ___RD C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-01 13:11 - 2013-12-01 13:09 - 00000494 _____ C:\Users\Tobias\Desktop\adwanleitung.txt
2013-12-01 12:04 - 2013-12-01 12:04 - 00009886 _____ C:\Windows\PFRO.log
2013-12-01 11:49 - 2013-12-01 11:49 - 00001115 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-01 11:49 - 2013-12-01 11:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-01 11:48 - 2013-12-01 11:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Tobias\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01091882 _____ C:\Users\Tobias\Desktop\adwcleaner.exe
2013-12-01 11:48 - 2013-12-01 11:48 - 01034531 _____ (Thisisu) C:\Users\Tobias\Desktop\JRT.exe
2013-11-29 16:14 - 2013-11-29 16:14 - 00018769 _____ C:\Users\Tobias\Downloads\Logfiles.7z
2013-11-29 15:28 - 2013-11-29 15:28 - 00018769 _____ C:\Users\Tobias\Desktop\Logfiles.7z
2013-11-29 15:27 - 2013-11-29 15:27 - 01110476 _____ C:\Users\Tobias\Downloads\7z920.exe
2013-11-29 15:27 - 2013-11-29 15:27 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-11-29 15:20 - 2013-11-29 15:19 - 00037235 _____ C:\Users\Tobias\Desktop\Addition.txt
2013-11-29 14:47 - 2013-11-29 14:47 - 00040242 _____ C:\Users\Tobias\Desktop\Gmer.txt
2013-11-29 14:32 - 2013-11-29 14:32 - 00000000 ____D C:\FRST
2013-11-29 14:31 - 2013-11-29 14:31 - 00000544 _____ C:\Users\Tobias\Desktop\defogger_disable.txt
2013-11-29 14:31 - 2013-11-29 14:31 - 00000168 _____ C:\Users\Tobias\defogger_reenable
2013-11-29 14:31 - 2012-07-09 21:26 - 00000000 ____D C:\Users\Tobias
2013-11-29 14:28 - 2013-11-29 14:28 - 00377856 _____ C:\Users\Tobias\Desktop\gmer_2.1.19163.exe
2013-11-29 14:28 - 2013-11-29 14:28 - 00050477 _____ C:\Users\Tobias\Desktop\Defogger.exe
2013-11-29 13:26 - 2013-11-29 13:26 - 00000000 _____ C:\Users\Tobias\Desktop\snap.txt
2013-11-29 13:21 - 2013-11-29 13:21 - 00000000 _____ C:\Windows\setuperr.log
2013-11-29 13:04 - 2013-11-29 13:04 - 00192524 _____ C:\Users\Tobias\Documents\cc_20131129_130425.reg
2013-11-29 12:56 - 2012-08-16 13:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\DAEMON Tools Lite
2013-11-29 12:55 - 2010-01-09 01:40 - 00000000 ____D C:\Windows\Panther
2013-11-29 12:51 - 2012-08-20 11:38 - 00000000 ____D C:\Program Files\CCleaner
2013-11-28 21:50 - 2012-07-19 22:55 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000UA
2013-11-28 21:50 - 2012-07-19 22:55 - 00003700 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1837355618-2121490773-1049443472-1000Core
2013-11-28 12:02 - 2013-12-01 22:26 - 00000000 ____D C:\Users\Tobias\Downloads\Schattenbilder in 3D
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\ProgramData\Aventail
2013-11-25 22:20 - 2012-10-02 19:34 - 00000000 ____D C:\Program Files\Aventail Connect
2013-11-25 15:25 - 2013-11-07 18:37 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\texstudio
2013-11-25 14:11 - 2013-08-08 10:10 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-25 14:11 - 2013-08-08 10:08 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 18:11 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-22 17:54 - 2012-09-25 14:53 - 00001870 _____ C:\Users\Tobias\AppData\Roaming\wklnhst.dat
2013-11-21 23:18 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-20 22:04 - 2012-07-10 11:36 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\TS3Client
2013-11-19 17:40 - 2013-07-03 15:10 - 00000000 ____D C:\Users\Tobias\Documents\Schule
2013-11-17 00:51 - 2013-11-17 00:51 - 00000000 ____D C:\Users\Tobias\AppData\Local\MSKLC
2013-11-17 00:50 - 2013-11-17 00:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Keyboard Layout Creator 1.4
2013-11-17 00:41 - 2013-11-17 00:41 - 00000190 _____ C:\Users\Tobias\Documents\altwintastenswitch.reg
2013-11-15 20:59 - 2013-05-11 15:49 - 00015364 ____H C:\Users\Tobias\.DS_Store
2013-11-14 17:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-12 23:00 - 2013-11-12 23:00 - 00000050 _____ C:\Users\Tobias\Desktop\Welcome our new leaders - Cats - Imgur.url
2013-11-12 20:01 - 2013-11-12 20:01 - 00010786 _____ C:\Users\Tobias\Documents\HonorarnoteNachhilfe.odt
2013-11-12 18:20 - 2012-07-09 21:33 - 00001427 _____ C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-12 18:13 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 14:48 - 2013-11-12 14:48 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 14:48 - 2013-11-12 14:48 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 14:48 - 2013-11-12 14:48 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 14:48 - 2013-11-12 14:48 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 14:48 - 2013-11-12 14:48 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 14:48 - 2013-11-12 14:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 14:48 - 2013-11-12 14:48 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 14:48 - 2013-11-12 14:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-12 14:47 - 2013-11-12 14:47 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-12 14:47 - 2013-11-12 14:47 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-12 14:47 - 2013-11-12 14:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-08 11:13 - 2013-02-13 23:15 - 00000000 ____D C:\Users\Tobias\Documents\Playstation Gems
2013-11-07 19:43 - 2013-11-07 19:43 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\MiKTeX
2013-11-07 19:41 - 2013-11-07 19:41 - 00000000 ____D C:\Users\Tobias\AppData\Local\MiKTeX
2013-11-07 19:40 - 2013-11-07 19:40 - 00000000 ____D C:\ProgramData\MiKTeX
2013-11-07 19:39 - 2013-11-07 19:38 - 00000000 ____D C:\Program Files (x86)\MiKTeX 2.9
2013-11-07 18:37 - 2013-11-07 18:37 - 00000000 ____D C:\Program Files (x86)\TeXstudio
2013-11-06 21:54 - 2012-10-11 17:15 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-05 18:41 - 2013-11-05 18:41 - 00060050 _____ C:\Users\Tobias\Documents\AwesomeXboxsettupWarthunder.blk
2013-11-04 21:00 - 2013-11-04 21:00 - 00064475 _____ C:\Users\Tobias\Documents\meineerstecfg.blk
2013-11-02 23:31 - 2013-11-02 19:54 - 00000000 ____D C:\ProgramData\WarThunder
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-02 23:30 - 2013-11-02 23:30 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-02 23:30 - 2013-11-02 19:54 - 00000000 ____D C:\Program Files (x86)\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\Documents\My Games
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2013-11-02 19:54 - 2013-11-02 19:54 - 00000000 ____D C:\Users\Tobias\AppData\Local\WarThunder

Files to move or delete:
====================
C:\Users\Tobias\AppData\Roaming\Camdata.ini
C:\Users\Tobias\AppData\Roaming\CamLayout.ini
C:\Users\Tobias\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\Tobias\AppData\Local\Temp\avgnt.exe
C:\Users\Tobias\AppData\Local\Temp\BackupSetup.exe
C:\Users\Tobias\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 00:41

==================== End Of Log ============================

--- --- ---

--- --- ---

Zwei Fragen hätte ich noch und zwar ob ich den AdBlock Plus für Chrome wieder installieren und ob das so gewollt ist das sich nun immer die Einstellungen von Chrome zurücksetzten, ansonsten läuft alles wieder einwandfrei, Danke!
Mit freundlichen Grüßen Tobi

schrauber · 03.12.2013, 09:53

Java, Flash, Adobe und Firefox updaten.

Zitat:

und ob das so gewollt ist das sich nun immer die Einstellungen von Chrome zurücksetzten

Deinstaliere Chrome, behalte keine Daten, installiere ihn neu, mit Adblocker. noch Probleme?

T04ST3R · 03.12.2013, 21:06

Ok hab alles deinstalliert und die neusten Versionen Installiert. Aber die Neuinstallation von Chrome hat mir auch nicht geholfen, immernoch die gleiche Fehlermeldung beim öffnen:

Code:

ATTFilter

Ihre Einstellungen können nicht gelesen werden. Einige Funktionen sind möglicherweise nicht verfügbar und Änderungen an Einstellungen werden nicht gespeichert.

dann sind zwar noch alle Lesezeichen da, aber die Addons sind weg und die Einstellungen auf den Standart zurück gesetzt.

schrauber · 04.12.2013, 11:55

Bei jedem Start von Chrome? Setz Chrome mal komplett zurück. Verbindest Du mit einem Google konto?

T04ST3R · 04.12.2013, 17:42

Ja bei jedem Start von Chrome und ohne Anmeldung, sehr komisch. Hab leider mit Google auch keine Antwort gefunden, anscheinend haben mehrere so ein Problem, aber nirgends ist eine Lösung zu finden. Aufjedenfall läuft ansonsten alles einwandfrei.

schrauber · 05.12.2013, 11:48

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, Reste entfernen lassen, nicht neu installieren

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)

Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
Code:
ATTFilter
```
:filefind
*Chrome*
:regfind
Chrome
         
```
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

T04ST3R · 05.12.2013, 18:57

SystemLook:

Code:

ATTFilter

							SystemLook 30.07.11 by jpshortstuff
Log created at 18:47 on 05/12/2013 by Tobias
Administrator - Elevation successful

========== filefind ==========

Searching for "*Chrome*"
C:\AdwCleaner\Quarantine\C\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\GoogleChromeRemotePlugin.dll.vir	--a---- 170016 bytes	[11:51 29/11/2013]	[15:28 31/10/2013] 2CC8A46BF351648B26C76DE8B5BE33A1
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\DefaultMonochromeBitmapConverter.html	--a---- 12885 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] 153F712AE9534CF25C26B41B1C8E1471
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\JAIMonochromeBitmapConverter.html	--a---- 12790 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] 44713880CB3235DED6F7BB630945C155
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\MonochromeBitmapConverter.html	--a---- 9710 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] 9723195FDCD74FE67543F118158A0709
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\class-use\DefaultMonochromeBitmapConverter.html	--a---- 6005 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] FB843E5821653AFB26868F47425C0631
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\class-use\JAIMonochromeBitmapConverter.html	--a---- 5973 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] CD54C7F825323CD99FEC2D397760A39B
C:\Program Files\Maple 16\eBookTools\fop-1.0\javadocs\org\apache\fop\util\bitmap\class-use\MonochromeBitmapConverter.html	--a---- 9607 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] C4B3BEC085E75EF964092E33BD241DC5
C:\Program Files\Maple 16\jre\lib\deploy\jqs\ff\chrome.manifest	--a---- 108 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] 7B43D30D4AE41144DE0BDF0DEC1CA287
C:\Program Files\Maple 16\uninstall\jre\lib\deploy\jqs\ff\chrome.manifest	--a---- 108 bytes	[13:33 13/04/2013]	[13:33 13/04/2013] 7B43D30D4AE41144DE0BDF0DEC1CA287
C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx	--a---- 69167 bytes	[15:50 24/09/2013]	[14:40 14/08/2013] 916D9FBCE5B015A18522DE15165264C9
C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\chrome.manifest	--a---- 385 bytes	[15:50 24/09/2013]	[14:40 14/08/2013] 2E00D29A095AE62518A5EF3929D1CCCA
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	--a---- 866256 bytes	[19:48 03/12/2013]	[03:54 04/12/2013] 9AB96C8AF64E7D3D45E0113B4F261187
C:\Program Files (x86)\Google\Chrome\Application\old_chrome.exe	--a---- 863184 bytes	[19:48 03/12/2013]	[02:48 04/12/2013] 376A9B411BF8B77D5BF84B24D0C7DACD
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome.dll	--a---- 26319824 bytes	[16:22 04/12/2013]	[02:47 04/12/2013] F3CA098ED00C23968742ACA972F7D8D0
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_100_percent.pak	--a---- 958859 bytes	[16:22 04/12/2013]	[02:29 04/12/2013] 2B2AA17E800F9E74ADA7753CB4BF7CE9
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_child.dll	--a---- 31266256 bytes	[16:22 04/12/2013]	[02:47 04/12/2013] F4299318F24C49B1ABBE7276EECC99FC
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_frame_helper.dll	--a---- 57296 bytes	[16:22 04/12/2013]	[02:47 04/12/2013] 93F53C6D0D2133689142253DF74DEA41
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_frame_helper.exe	--a---- 83408 bytes	[16:22 04/12/2013]	[02:47 04/12/2013] B2B6EE8C0AF25A82D5E0880BBCFE1E66
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_launcher.exe	--a---- 123856 bytes	[16:22 04/12/2013]	[02:47 04/12/2013] 3CAA2F4E70FC2A367E059818F917EB5A
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\chrome_touch_100_percent.pak	--a---- 971321 bytes	[16:22 04/12/2013]	[02:29 04/12/2013] 8E773A2DEEF368C729A2D488CC08D16A
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\npchrome_frame.dll	--a---- 2103760 bytes	[16:22 04/12/2013]	[02:48 04/12/2013] BC07CB3735AFDE914A109C168FB7F2D6
C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppgooglenaclpluginchrome.dll	--a---- 399312 bytes	[16:22 04/12/2013]	[02:48 04/12/2013] 4F5BBEFFA8E716DAD5FED3ED0160DC4D
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome.dll	--a---- 27205584 bytes	[22:00 04/12/2013]	[03:53 04/12/2013] 3EB8FBC57F50F946EE00EC459AAF78B6
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_100_percent.pak	--a---- 1089812 bytes	[22:01 04/12/2013]	[02:59 04/12/2013] 4D05F7A568E6CA080B51ABA75D899410
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_child.dll	--a---- 32022480 bytes	[22:01 04/12/2013]	[03:53 04/12/2013] 00B0BE69A1AD8018921ABA682427B456
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_frame_helper.dll	--a---- 57296 bytes	[22:01 04/12/2013]	[03:53 04/12/2013] 21C5B210279FDF1AC5673960284DA556
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_frame_helper.exe	--a---- 83408 bytes	[22:01 04/12/2013]	[03:53 04/12/2013] 78F2C250715F2B60B8F0006E99DB2465
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_launcher.exe	--a---- 121296 bytes	[22:01 04/12/2013]	[03:53 04/12/2013] CF322CA31D108848D2E2817F36AB3814
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\chrome_touch_100_percent.pak	--a---- 997421 bytes	[22:01 04/12/2013]	[02:59 04/12/2013] 135644097F709254383209C979A1549A
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\npchrome_frame.dll	--a---- 2221008 bytes	[22:01 04/12/2013]	[03:54 04/12/2013] 796AB3E541BC37006CB139F8CFF7B957
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\ppgooglenaclpluginchrome.dll	--a---- 399312 bytes	[22:01 04/12/2013]	[03:54 04/12/2013] 98972DEC0FE672760F58599F5A330C19
C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\chrome.7z	--a---- 147439587 bytes	[22:00 04/12/2013]	[03:54 04/12/2013] 13429727AE6E5C2113BC33898B1B793F
C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\32.0.1700.41\32.0.1700.41_chrome_installer.exe	--a---- 36502880 bytes	[22:00 04/12/2013]	[16:35 04/12/2013] AEAF835393293D66550AD97F58D3EB85
C:\Program Files (x86)\MATLAB\R2013a Student\sys\java\jre\win32\jre\lib\deploy\jqs\ff\chrome.manifest	--a---- 106 bytes	[18:13 08/05/2013]	[09:10 26/04/2012] 51250FED97D4812C53EB471F82363E87
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner-windows\components\chrome.xpt	--a---- 296 bytes	[18:14 08/05/2013]	[12:47 24/02/2011] D8688D0A6703370433C2F398BFFDF5F6
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner-windows\defaults\profile\chrome\userChrome-example.css	--a---- 1078 bytes	[18:14 08/05/2013]	[12:47 24/02/2011] 4788FDAA51B0A238CB21F5C2877EF06D
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner-windows\defaults\profile\US\chrome\userChrome-example.css	--a---- 1078 bytes	[18:14 08/05/2013]	[12:47 24/02/2011] 4788FDAA51B0A238CB21F5C2877EF06D
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner15-windows\chrome.manifest	--a---- 1960 bytes	[18:14 08/05/2013]	[14:20 14/09/2012] EEE4A35083C5226EB4896FA4666C78EF
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner15-windows\chrome\toolkit\content\global\test-ipcbrowser-chrome.js	--a---- 3571 bytes	[18:14 08/05/2013]	[14:20 14/09/2012] 9319BDE7C59C052796009433F0016FF3
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner15-windows\defaults\profile\chrome\userChrome-example.css	--a---- 1342 bytes	[18:14 08/05/2013]	[14:20 14/09/2012] DED093337E16359F81D452633DE1EBDE
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner15-windows\defaults\profile\US\chrome\userChrome-example.css	--a---- 1342 bytes	[18:14 08/05/2013]	[14:20 14/09/2012] DED093337E16359F81D452633DE1EBDE
C:\Program Files (x86)\MATLAB\R2013a Student\sys\jxbrowser\win32\xulrunner\xulrunner15-windows\modules\ChromeManifestParser.jsm	--a---- 4771 bytes	[18:14 08/05/2013]	[14:20 14/09/2012] FD2C7CF988CAB28EF572249F7D58E9D5
C:\Program Files (x86)\MATLAB\R2013a Student\sys\webrenderer\windows\corecomponents\chrome\app-chrome.manifest	--a---- 2227 bytes	[18:13 08/05/2013]	[18:12 22/12/2006] 4D7B33C260635E635815C3B3661D0240
C:\Program Files (x86)\MATLAB\R2013a Student\sys\webrenderer\windows\corecomponents\components\chrome.xpt	--a---- 344 bytes	[18:13 08/05/2013]	[18:12 22/12/2006] 58A54C11392169799D48E7E083ABD431
C:\Program Files (x86)\MATLAB\R2013a Student\sys\webrenderer\windows\corecomponents\components\wr_chrome.dll	--a---- 53248 bytes	[18:13 08/05/2013]	[20:20 11/01/2013] C472F577F1EBDBA2E75A4095FE6037A8
C:\Program Files (x86)\Mozilla Firefox.bak\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\chrome.manifest	--a---- 788 bytes	[17:46 25/04/2013]	[10:02 10/07/2012] E51806784B9D033D576E684441FD62C8
C:\Program Files (x86)\Steam\bin\chromehtml.dll	--a---- 1135016 bytes	[21:36 09/07/2012]	[02:51 04/12/2013] 5D8CD307324298B4D64023CD981E2577
C:\Program Files (x86)\Steam\resource\layout\gamespage_grid_chrome.layout	--a---- 4050 bytes	[21:36 09/07/2012]	[23:49 14/06/2013] CCFFEC30C8B774ED70285B70E1BC9175
C:\Program Files (x86)\Steam\skins\PixelVision\resource\layout\gamespage_grid_chrome.layout	--a---- 2297 bytes	[11:39 06/09/2013]	[20:59 29/11/2011] F3CC344F5CDCA0141C6A83880F076758
C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Global Offensive\bin\chromehtml.dll	--a---- 900520 bytes	[08:37 18/10/2013]	[08:42 18/10/2013] E31267D99ADB49FA4DA9902548996934
C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\materials\sprites\store\trails\googlechrome.vmt	--a---- 125 bytes	[19:25 12/09/2013]	[19:25 12/09/2013] 340560E0BFA6D2A72DE2BF31413A14C6
C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\materials\sprites\store\trails\googlechrome.vtf	--a---- 11144 bytes	[19:25 12/09/2013]	[19:25 12/09/2013] 5D821BF3D113F872911D784A76FE7C70
C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\bin\chromehtml.dll	--a---- 935848 bytes	[20:09 03/12/2013]	[20:10 03/12/2013] 15A7E89BFC549E0A7BEB86EDD7A72383
C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\bin\chromehtml.dll	--a---- 980304 bytes	[19:06 23/10/2013]	[19:06 23/10/2013] 2656AF307A129A2BAE702D9A3B75F95C
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\metal\Chrome_Metal.vmt	------- 137 bytes	[15:17 18/09/2012]	[19:00 04/07/2010] AACF4E7078BBFCBBBD27C87F2D965E34
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\metal\Chrome_Metal.vtf	------- 120 bytes	[15:18 18/09/2012]	[19:00 04/07/2010] 27A1FBCDE1B6D4E31C76B490557171E6
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_canteen\canteenbin_chrome.vmt	------- 216 bytes	[15:17 18/09/2012]	[19:17 04/07/2010] 76E060A44EABAF0082B22247531C4454
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_canteen\canteenbin_chrome.vtf	------- 904 bytes	[15:18 18/09/2012]	[19:17 04/07/2010] D37AB5D0AAF58EA3EF6AF42E611ABC6C
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_industrial\impeller_chrome.vmt	------- 821 bytes	[15:17 18/09/2012]	[01:32 01/05/2012] 708DF06F7080C96B426967F5496D5D2A
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_industrial\impeller_chrome.vtf	------- 699272 bytes	[15:18 18/09/2012]	[19:25 04/07/2010] 45F84B7DF72A430A8686CD81B2FE3144
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_industrial\impeller_chrome_NRM.vtf	------- 699272 bytes	[15:18 18/09/2012]	[19:25 04/07/2010] 00C0D0FC06AA08E93B451776B647EEFE
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_pipes\gaspipe01_chrome.vmt	------- 523 bytes	[15:17 18/09/2012]	[09:01 10/08/2012] C8FCA1BD4848881C1FFF4335CC1785F9
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_pipes\gaspipe01_chrome.vtf	------- 349688 bytes	[15:18 18/09/2012]	[19:06 04/07/2010] 66D928B1453B293BE08DC6D32B36D67D
C:\Program Files (x86)\Steam\SteamApps\sourcemods\BMS\materials\models\props_pipes\gaspipe01_chrome_normal.vtf	------- 349688 bytes	[15:18 18/09/2012]	[19:06 04/07/2010] 1494CC3FB78284D3F96440B2BFE3EEE8
C:\Program Files (x86)\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_env.jpg	--a---- 37223 bytes	[17:28 28/10/2013]	[22:28 17/05/2010] 8899546D1D9F228A47A83BF5C309C130
C:\Program Files (x86)\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_env2.jpg	--a---- 48098 bytes	[17:28 28/10/2013]	[13:53 22/05/2010] 86594FB713DD60E2D222DBEF4CC28218
C:\Program Files (x86)\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_metal.jpg	--a---- 18903 bytes	[17:28 28/10/2013]	[19:00 22/05/2010] 4CC055324675D5E5497AE88E8E01D391
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk	--a---- 2212 bytes	[19:48 03/12/2013]	[22:01 04/12/2013] 09C807C9FDE4A8D91529C3112B80FA61
C:\Users\Public\Desktop\Google Chrome.lnk	--a---- 2177 bytes	[19:48 03/12/2013]	[22:01 04/12/2013] 1895D4F5B1B2AEE4994A8457A7DED904
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt	--a---- 4 bytes	[17:47 05/12/2013]	[17:47 05/12/2013] 1D05B66DDA328F891A203C9133D57924
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\feegenemlbjkbnfpgdmjddbeiecdbpob\0.3.3_0\chrome.manifest	--a---- 137 bytes	[13:23 30/11/2013]	[13:23 30/11/2013] 3A6B5932C320F07C7192AC993F75CA0E
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-devtools_devtools_0.localstorage	--a---- 3072 bytes	[11:58 14/08/2012]	[15:45 29/11/2013] A12F8A30FE760439245C994DCFEBC300
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-devtools_devtools_0.localstorage-journal	--a---- 3608 bytes	[15:45 29/11/2013]	[15:45 29/11/2013] 46A3B5EABB65C86A64AA613569D79E6A
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_amfclgbdpgndipgoegfpkkgobahigbcl_0.localstorage	--a---- 3072 bytes	[11:52 29/11/2013]	[12:24 29/11/2013] 490A60090D545A9ADAFBAAFFA9D28759
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_amfclgbdpgndipgoegfpkkgobahigbcl_0.localstorage-journal	--a---- 3608 bytes	[12:19 29/11/2013]	[12:24 29/11/2013] E7805AB930EB4B8D9F198DE1B45628AE
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cfhdojbkjhnklbpkdaibdccddilifddb_0.localstorage	--a---- 3072 bytes	[11:46 20/07/2012]	[17:41 04/12/2013] A18BF289AE6183AD1C6D08E2F460D9F2
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cfhdojbkjhnklbpkdaibdccddilifddb_0.localstorage-journal	--a---- 3608 bytes	[13:20 30/11/2013]	[17:41 04/12/2013] 70971F7B154093FF9A6AB13B588A2A45
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_chrome.google.com_0.localstorage	--a---- 3072 bytes	[13:07 30/11/2013]	[17:22 04/12/2013] D36B9388483FDF626277D26C2004DC49
C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_chrome.google.com_0.localstorage-journal	--a---- 3608 bytes	[13:07 30/11/2013]	[17:22 04/12/2013] FEDDC9A55AF1C14C44D9EE348D08F73B
C:\Users\Tobias\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3VRG30TX\chrome-16[1].png	--a---- 586 bytes	[19:46 03/12/2013]	[19:46 03/12/2013] 1A38C1EDD5B2D347EA94F4F328EB60E2
C:\Users\Tobias\AppData\Local\Temp\chrome_installer.log	--a---- 21716 bytes	[19:46 03/12/2013]	[22:14 04/12/2013] C03B00533FDF0BEAF03822C4680E9031
C:\Users\Tobias\AppData\Local\Temp\jrt\chrome.bat	--a---- 13955 bytes	[12:18 01/12/2013]	[21:22 05/11/2013] C4A5476A9D54B400F1623A2EE7DDA5C5
C:\Users\Tobias\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk	--a---- 2277 bytes	[19:48 03/12/2013]	[16:22 04/12/2013] 7FF95374875A6A47948EB2848887C577
C:\Users\Tobias\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk	--a---- 2288 bytes	[19:48 03/12/2013]	[19:48 03/12/2013] 6DD0D950BF4F732F5A679DB6C4B0583F
C:\Users\Tobias\Desktop\ChromeSetup.exe	--a---- 819192 bytes	[19:45 03/12/2013]	[19:45 03/12/2013] 64C996BA549273D590CF3563C8D0DE3D
C:\Users\Tobias\Documents\Assembly Coding\A Basic Virus Writing Primer_files\chrome.css	--a---- 177010 bytes	[15:16 17/06/2013]	[15:16 17/06/2013] C47A6CD5BA0E8508D0BAD001826A6A7C
C:\Users\Tobias\Documents\Assembly Coding\A Basic Virus Writing Primer_files\chrome.js	--a---- 265148 bytes	[15:16 17/06/2013]	[15:16 17/06/2013] 2B16F2C2C7D1ECA1115E844BC0A19531
C:\Users\Tobias\Documents\Assembly Coding\Hacking Into Computer Systems - Beginners_files\chrome.css	--a---- 177010 bytes	[15:13 17/06/2013]	[15:13 17/06/2013] C47A6CD5BA0E8508D0BAD001826A6A7C
C:\Users\Tobias\Documents\Assembly Coding\Hacking Into Computer Systems - Beginners_files\chrome.js	--a---- 265148 bytes	[15:13 17/06/2013]	[15:13 17/06/2013] 2B16F2C2C7D1ECA1115E844BC0A19531
C:\Users\Tobias\Documents\Assembly Coding\Virus Programming (Basics) #1- Hacking-Virus Programming Asm_files\chrome.css	--a---- 177010 bytes	[15:10 17/06/2013]	[15:10 17/06/2013] C47A6CD5BA0E8508D0BAD001826A6A7C
C:\Users\Tobias\Documents\Assembly Coding\Virus Programming (Basics) #1- Hacking-Virus Programming Asm_files\chrome.js	--a---- 265148 bytes	[15:10 17/06/2013]	[15:10 17/06/2013] 2B16F2C2C7D1ECA1115E844BC0A19531
C:\Users\Tobias\Documents\QLPrism\ql\data\extensions\QLDemoPlayer@qldp\chrome.manifest	--a---- 222 bytes	[02:32 02/08/2013]	[05:04 13/07/2013] 029C7549D5DF3E00F615A5A1907BB216
C:\Users\Tobias\Documents\QLPrism\ql\data\extensions\qlprismtools@qlprism.us\chrome.manifest	--a---- 9499 bytes	[02:32 02/08/2013]	[07:07 13/07/2013] 3142D42A207CF60429CB527E4C2C7A5A
C:\Users\Tobias\Documents\QLPrism\xul\components\chrome.xpt	--a---- 296 bytes	[01:40 02/08/2013]	[08:58 13/07/2013] D8688D0A6703370433C2F398BFFDF5F6
C:\Users\Tobias\Documents\QLPrism\xul\defaults\profile\chrome\userChrome-example.css	--a---- 1078 bytes	[01:40 02/08/2013]	[14:47 06/03/2012] 4788FDAA51B0A238CB21F5C2877EF06D
C:\Users\Tobias\Documents\QLPrism\xul\defaults\profile\US\chrome\userChrome-example.css	--a---- 1078 bytes	[01:40 02/08/2013]	[14:47 06/03/2012] 4788FDAA51B0A238CB21F5C2877EF06D
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\App\Firefox\chrome.manifest	--a---- 36 bytes	[16:46 08/01/2013]	[14:09 04/01/2013] 8F2E87A15606DE2AD90C1E6DEAED4624
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\Data\profile\chromeappsstore.sqlite	--a---- 98304 bytes	[16:49 08/01/2013]	[16:49 08/01/2013] 1474C2D97AC5D61AB040259F43D2FB7E
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\Data\profile\extensions\https-everywhere@eff.org\chrome.manifest	--a---- 2149 bytes	[13:42 18/02/2013]	[16:00 18/01/2013] 092B970C4939478D478CEB78ABE43BDB
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\Data\profile\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest	--a---- 7490 bytes	[16:46 08/01/2013]	[17:23 09/10/2012] 587DC04717333B0C205F9B7F9455B12A
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\Data\profile\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest.jar	--a---- 3541 bytes	[16:46 08/01/2013]	[17:23 09/10/2012] B40F171C14DA39495736DC3BEEB62F11
C:\Users\Tobias\Documents\TOR\Tor Browser\FirefoxPortable\Data\profile\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}\chrome.manifest.nojar	--a---- 2534 bytes	[16:46 08/01/2013]	[17:23 09/10/2012] CBB136ED55724EB1690AC45628EF2CE6
C:\Users\Tobias\Documents\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_env.jpg	--a---- 37223 bytes	[17:37 28/10/2013]	[22:28 17/05/2010] 8899546D1D9F228A47A83BF5C309C130
C:\Users\Tobias\Documents\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_env2.jpg	--a---- 48098 bytes	[17:37 28/10/2013]	[13:53 22/05/2010] 86594FB713DD60E2D222DBEF4CC28218
C:\Users\Tobias\Documents\Wolf Whisperer\Stuff\Textures\textures\base_wall\chrome_metal.jpg	--a---- 18903 bytes	[17:37 28/10/2013]	[19:00 22/05/2010] 4CC055324675D5E5497AE88E8E01D391
C:\Users\Tobias\Documents\Wolf Whisperer\WolfcamQL\wolfcam-ql\textures\base_wall\chrome_env.jpg	--a---- 37223 bytes	[17:37 28/10/2013]	[22:28 17/05/2010] 8899546D1D9F228A47A83BF5C309C130
C:\Users\Tobias\Documents\Wolf Whisperer\WolfcamQL\wolfcam-ql\textures\base_wall\chrome_env2.jpg	--a---- 48098 bytes	[17:37 28/10/2013]	[13:53 22/05/2010] 86594FB713DD60E2D222DBEF4CC28218
C:\Users\Tobias\Documents\Wolf Whisperer\WolfcamQL\wolfcam-ql\textures\base_wall\chrome_metal.jpg	--a---- 18903 bytes	[17:37 28/10/2013]	[19:00 22/05/2010] 4CC055324675D5E5497AE88E8E01D391
C:\Users\Tobias\Downloads\chromeinstall-7u45 (1).exe	--a---- 915368 bytes	[16:57 03/12/2013]	[16:57 03/12/2013] 15D87D5EAD5FA2C59640FD55A69C2370
C:\Users\Tobias\Downloads\chromeinstall-7u45.exe	--a---- 915368 bytes	[14:36 02/12/2013]	[14:36 02/12/2013] 15D87D5EAD5FA2C59640FD55A69C2370
C:\Users\Tobias\Music\iTunes\iTunes Media\Mobile Applications\Chrome 23.1271.100.ipa	--a---- 16449755 bytes	[17:45 05/01/2013]	[17:46 05/01/2013] 3EEE026F7CC3B996CA3678D220C5E998
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\chrome.browser	--a---- 2107 bytes	[04:59 28/03/2012]	[04:59 28/03/2012] 8C54E6C4F9E0CC3274EA6D04AAE9436B
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\chrome.browser	--a---- 2107 bytes	[02:59 28/03/2012]	[02:59 28/03/2012] 8C54E6C4F9E0CC3274EA6D04AAE9436B
C:\WINDOWS\Prefetch\CHROME.EXE-68377183.pf	--a---- 208034 bytes	[21:55 19/07/2012]	[19:46 03/12/2013] 6345256C3FA8566760B01C97B5D79669
C:\WINDOWS\Temp\chrome_installer.log	--a---- 1520 bytes	[17:44 04/12/2013]	[22:14 04/12/2013] D739B87182312178DE28B155D74C03F4
C:\WINDOWS\Web\Wallpaper\Dell\Win7 Chrome 1920x1200.jpg	--a---- 598722 bytes	[00:40 09/01/2010]	[20:38 20/04/2009] E94D9D67C70C6A50BADC6CACB1A2D3CF

========== regfind ==========

Searching for "Chrome"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Re_markit]
"ia"="IE,FF,Chrome"
[HKEY_CURRENT_USER\Software\Clients\StartMenuInternet]
@="Google Chrome"
[HKEY_CURRENT_USER\Software\Google\Chrome]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE501758C90012C418]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE501758C90012C418]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5091791E0012F418]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5091791E0012F418]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50A2E6740012F668]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50A2E6740012F668]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50B5708F0012F668]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50B5708F0012F668]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50BE88D80012F668]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50BE88D80012F668]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50F8E9E400130BD0]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE50F8E9E400130BD0]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE513D06C4001371D0]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE513D06C4001371D0]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE51D39520000CE9D0]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE51D39520000CE9D0]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5224D150000CA7D0]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5224D150000CA7D0]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5237A3C2000CA7D0]
[HKEY_CURRENT_USER\Software\Microsoft\DirectInput\CHROME.EXE5237A3C2000CA7D0]
"Name"="CHROME.EXE"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\1bf1ffe1_0]
@="{0.0.0.00000000}.{344aefb1-c1bf-44a7-a034-30fc453f4f8d}|\Device\HarddiskVolume3\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\7cb20835_0]
@="{0.0.0.00000000}.{344aefb1-c1bf-44a7-a034-30fc453f4f8d}|\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\98ebbdf8_0]
@="{0.0.0.00000000}.{5ea3ba0b-eb2b-4bd1-839d-a376b602aca8}|\Device\HarddiskVolume3\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cfg\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mat\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mn\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mw\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tex\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PhotoPrintingWizard\Brother MFC-7360N Printer]
"PrintTicket"="<?xml version="1.0"?>
<psf:PrintTicket xmlns:psf="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema" version="1" xmlns:psk="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords" xmlns:ns0001="hxxp://schemas.brother.info/mfc/printing/2006/11/printschemakeywords"><psf:Feature name="psk:PageOrientation"><psf:Option name="psk:Landscape"/></psf:Feature><psf:Property name="ns0001:PageMediaSizeData"><psf:Property name="ns0001:CustomUnitType"><psf:Value xsi:type="xsd:string">mm</psf:Value></psf:Property><psf:Property name="ns0001:TransverseMode"><psf:Value xsi:type="xsd:string">Off</psf:Value></psf:Property><psf:Property name="ns0001:ThicknessType"><psf:Value xsi:type="xsd:string">Regular</psf:Value></psf:Property><psf:Property name="ns0001:Cu
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PhotoPrintingWizard\Brother MFC-7360N Printer]
"PrintCapabilites"="<?xml version="1.0"?>
<psf:PrintCapabilities xmlns:psf="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema" version="1" xmlns:brpsk="hxxp://schemas.brother.info/mfc/printing/2006/11/printschemakeywords" xmlns:psk="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords"><psf:Feature name="psk:PageMediaSize"><psf:Property name="psk:DisplayName"><psf:Value xsi:type="xsd:string">Papiergröße</psf:Value></psf:Property><psf:Property name="psf:SelectionType"><psf:Value xsi:type="xsd:QName">psk:PickOne</psf:Value></psf:Property><psf:Option name="psk:ISOA4" constrained="psk:None"><psf:Property name="psk:DisplayName"><psf:Value xsi:type="xsd:string">A4</psf:Value></psf:Property><psf:ScoredProperty name="psk:MediaSizeWidth"><psf:Value xsi:type="
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid"="ChromeHTML"
[HKEY_CURRENT_USER\Software\Piriform\CCleaner]
"(App)Google Chrome - Cookies"="True"
[HKEY_CURRENT_USER\Software\Classes\.htm]
@="ChromeHTML"
[HKEY_CURRENT_USER\Software\Classes\.html]
@="ChromeHTML"
[HKEY_CURRENT_USER\Software\Classes\.shtml]
@="ChromeHTML"
[HKEY_CURRENT_USER\Software\Classes\.xht]
@="ChromeHTML"
[HKEY_CURRENT_USER\Software\Classes\.xhtml]
@="ChromeHTML"
[HKEY_CURRENT_USER\Software\Classes\ftp\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_CURRENT_USER\Software\Classes\ftp\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_CURRENT_USER\Software\Classes\http\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_CURRENT_USER\Software\Classes\http\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_CURRENT_USER\Software\Classes\https\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_CURRENT_USER\Software\Classes\https\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm\OpenWithProgids]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.html\OpenWithProgids]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xht\OpenWithProgIds]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds]
"ChromeHTML"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML]
@="Chrome HTML Document"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
@=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\delegate_execute.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"ServerExecutable"="C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\delegate_execute.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome]
@="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationDescription"="Google Chrome ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle lädt und dabei äußerst stabil und nutzerfreundlich ist. Dank des integrierten Malware- und Phishing-Schutzes können Sie bedenkenlos im Internet surfen."
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationIcon"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationName"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".htm"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".html"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".shtml"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xht"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xhtml"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".webp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\Startmenu]
"StartMenuInternet"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"ftp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"http"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"https"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"irc"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"mailto"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"mms"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"news"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"nntp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"sms"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"smsto"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"tel"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"urn"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"webcal"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"HideIconsCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --hide-icons"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ShowIconsCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --show-icons"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
"Path"="C:\Program Files (x86)\Google\Chrome\Application"
[HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications]
"Google Chrome"="Software\Clients\StartMenuInternet\Google Chrome\Capabilities"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"name"="Google Chrome binaries"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"CommandLine"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe" --query-eula-acceptance --system-level"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"CommandLine"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe" --multi-install --app-launcher --ensure-google-update-present"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-cf]
"CommandLine"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe" --multi-install --quick-enable-cf --system-level"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"name"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\install-extension]
"CommandLine"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --limited-install-from-webstore=%1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\on-os-upgrade]
"CommandLine"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe" --on-os-upgrade --multi-install --chrome --system-level --verbose-logging"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}]
"name"="Google Chrome App Launcher"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"UninstallString"="C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"ap"="-multi-chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ap"="-multi-chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallString"="C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallArguments"=" --uninstall --multi-install --chrome --system-level"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"LastInstallerSuccessLaunchCmdLine"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy]
"Method"="jchrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
@="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Localized Name"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\MediaPlayer\ShimInclusionList\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\chromeinstall-7u7_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\chromeinstall-7u7_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\chrome_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\chrome_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayName"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"UninstallString"=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\Installer\setup.exe" --uninstall --multi-install --chrome --system-level"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"InstallLocation"="C:\Program Files (x86)\Google\Chrome\Application"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayIcon"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
"Path"="C:\Program Files (x86)\Google\Chrome\Application"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
@=""C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\delegate_execute.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"ServerExecutable"="C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.41\delegate_execute.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome]
@="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationDescription"="Google Chrome ist ein Webbrowser, der Webseiten und Apps in Sekundenschnelle lädt und dabei äußerst stabil und nutzerfreundlich ist. Dank des integrierten Malware- und Phishing-Schutzes können Sie bedenkenlos im Internet surfen."
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationIcon"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationName"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".htm"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".html"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".shtml"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xht"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xhtml"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".webp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\Startmenu]
"StartMenuInternet"="Google Chrome"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"ftp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"http"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"https"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"irc"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"mailto"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"mms"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"news"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"nntp"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"sms"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"smsto"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"tel"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"urn"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"webcal"="ChromeHTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"HideIconsCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --hide-icons"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ShowIconsCommand"=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --show-icons"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\RegisteredApplications]
"Google Chrome"="Software\Clients\StartMenuInternet\Google Chrome\Capabilities"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\AppDataLow\Software\Re_markit]
"ia"="IE,FF,Chrome"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Clients\StartMenuInternet]
@="Google Chrome"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Google\Chrome]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE501758C90012C418]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE501758C90012C418]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5091791E0012F418]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5091791E0012F418]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50A2E6740012F668]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50A2E6740012F668]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50B5708F0012F668]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50B5708F0012F668]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50BE88D80012F668]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50BE88D80012F668]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50F8E9E400130BD0]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE50F8E9E400130BD0]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE513D06C4001371D0]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE513D06C4001371D0]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE51D39520000CE9D0]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE51D39520000CE9D0]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5224D150000CA7D0]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5224D150000CA7D0]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5237A3C2000CA7D0]
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\DirectInput\CHROME.EXE5237A3C2000CA7D0]
"Name"="CHROME.EXE"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\1bf1ffe1_0]
@="{0.0.0.00000000}.{344aefb1-c1bf-44a7-a034-30fc453f4f8d}|\Device\HarddiskVolume3\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\7cb20835_0]
@="{0.0.0.00000000}.{344aefb1-c1bf-44a7-a034-30fc453f4f8d}|\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\98ebbdf8_0]
@="{0.0.0.00000000}.{5ea3ba0b-eb2b-4bd1-839d-a376b602aca8}|\Device\HarddiskVolume3\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cfg\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mat\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mn\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mw\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tex\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\PhotoPrintingWizard\Brother MFC-7360N Printer]
"PrintTicket"="<?xml version="1.0"?>
<psf:PrintTicket xmlns:psf="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema" version="1" xmlns:psk="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords" xmlns:ns0001="hxxp://schemas.brother.info/mfc/printing/2006/11/printschemakeywords"><psf:Feature name="psk:PageOrientation"><psf:Option name="psk:Landscape"/></psf:Feature><psf:Property name="ns0001:PageMediaSizeData"><psf:Property name="ns0001:CustomUnitType"><psf:Value xsi:type="xsd:string">mm</psf:Value></psf:Property><psf:Property name="ns0001:TransverseMode"><psf:Value xsi:type="xsd:string">Off</psf:Value></psf:Property><psf:Property name="ns0001:ThicknessType"><psf:Value xsi:type="xsd:string">Regular</psf:Value></ps
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\PhotoPrintingWizard\Brother MFC-7360N Printer]
"PrintCapabilites"="<?xml version="1.0"?>
<psf:PrintCapabilities xmlns:psf="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema" version="1" xmlns:brpsk="hxxp://schemas.brother.info/mfc/printing/2006/11/printschemakeywords" xmlns:psk="hxxp://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords"><psf:Feature name="psk:PageMediaSize"><psf:Property name="psk:DisplayName"><psf:Value xsi:type="xsd:string">Papiergröße</psf:Value></psf:Property><psf:Property name="psf:SelectionType"><psf:Value xsi:type="xsd:QName">psk:PickOne</psf:Value></psf:Property><psf:Option name="psk:ISOA4" constrained="psk:None"><psf:Property name="psk:DisplayName"><psf:Value xsi:type="xsd:string">A4</psf:Value></psf:Property><psf:ScoredProperty name="p
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"Progid"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Piriform\CCleaner]
"(App)Google Chrome - Cookies"="True"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\.htm]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\.html]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\.shtml]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\.xht]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\.xhtml]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\ftp\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\ftp\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\http\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\http\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\https\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\https\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe"="Google Chrome"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\.htm]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\.html]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\.shtml]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\.xht]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\.xhtml]
@="ChromeHTML"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\ftp\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\ftp\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\http\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\http\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\https\DefaultIcon]
@="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\https\shell\open\command]
@=""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1""
[HKEY_USERS\S-1-5-21-1837355618-2121490773-1049443472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\Tobias\AppData\Local\Google\Chrome\Application\chrome.exe"="Google Chrome"

-= EOF =-

schrauber · 06.12.2013, 10:43

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files (x86)\Google\Chrome
reg: reg delete "HKEY_CURRENT_USER\Software\Google\Chrome" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Chrome neu installieren.

04.12.2013, 11:55	#11
schrauber /// the machine /// TB-Ausbilder	Win7: Snap.Do und Internet Probleme Bei jedem Start von Chrome? Setz Chrome mal komplett zurück. Verbindest Du mit einem Google konto? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Win7: Snap.Do und Internet Probleme

Log-Analyse und Auswertung: Win7: Snap.Do und Internet Probleme