Windows 7: 2 Rechner mit fake-Java-update und nicht eingrenzbarer Audio-Werbung in chrome befallen

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:12 on 30/11/2013 (Markus)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-11-2013
Ran by Markus (administrator) on MARKUS-PC on 30-11-2013 13:14:55
Running from C:\Users\Markus\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Akamai Technologies, Inc.) C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Akamai Technologies, Inc.) C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(Intenium) C:\Program Files (x86)\OXXOGames\GPlayer\GameCenterNotifier.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(FUJIFILM Corporation) C:\Program Files (x86)\FinePixViewer\QuickDCF2.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\Markus\Downloads\Defogger.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024 2010-05-27] (AMD)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google)
HKCU\...\Run: [GoogleChromeAutoLaunch_B7BAB472F6EC664C4B3EB3EEA8AE05F9] - C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe [863184 2013-11-14] (Google Inc.)
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [455608 2013-04-17] (TomTom)
HKCU\...\Run: [Spiele Post] - C:\Program Files (x86)\OXXOGames\GPlayer\GameCenterNotifier.exe [480328 2013-04-24] (Intenium)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
MountPoints2: {4a6da567-6cd0-11e0-979a-806e6f6e6963} - E:\SETUP.EXE
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1719944 2013-04-01] (Ask)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444472 2013-08-21] (G Data Software AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x00748C97D307CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://forum.rakard.com/index.php?form=Search&searchID=19307&highlight=verteilung+mangel
hxxp://forum.rakard.com/index.php?page=Thread&threadID=667
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO: DeLorme Send To GPS - {FBAAD182-3C7A-4BC4-A5E9-207B8E0F02FD} - C:\Program Files\DeLorme\SendToGPS\PNPluginForIE-x64.dll (DeLorme)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: DeLorme Send To GPS - {FBAAD182-3C7A-4BC4-A5E9-207B8E0F02FD} - C:\Program Files (x86)\DeLorme\SendToGPS\PNPluginForIE.dll (DeLorme)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{77F702B8-A739-47AD-AE9D-2E992BBDC3C8}: [NameServer]8.8.8.8

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR Extension: (Sudoku) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\agdhembpgcpfegeigidembjopfhghnpj\1.0.1.0_0
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.3_0
CHR Extension: (Fabulous) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ambjmeohlajelahhhniggkkceagdlcgj\31.2_0
CHR Extension: (Sort by Name) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadojiibgbdp\2.0.0_0
CHR Extension: (Google Drive) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (ImageZoom) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmigpjhdoghhhmecocklaokmmamgobo\1.5_0
CHR Extension: (YouTube Options) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdokagampppgbnjfdlkfpphniapiiifn\1.8.148_0
CHR Extension: (OneTab) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall\1.6_0
CHR Extension: (Tampermonkey) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo\3.5.3630.77_0
CHR Extension: (Color Changer for Facebook) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\dheljpcbhldkdiabdemaflamgfnbpnkd\19.0_0
CHR Extension: (MondoZoo - Zoo game) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejafdpedefplpgoacblaboikebhhjlib\1.1.0.0_0
CHR Extension: (Sudoku) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbldalicehmlaalddffibogeplifangc\1.0.3_0
CHR Extension: (ProxTube) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fclefogcenncfmmekelnpgpehiglcjln\1.2.5_0
CHR Extension: (Vimeo\u2122 Download Videos) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\geeljcibkkackafmeepgadbfgmpjmdeg\3.0.0_0
CHR Extension: (Lord of Ultima) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdheeblenjmceeppomdgokgilmkonced\1.0.12_0
CHR Extension: (Green Farm) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbgdenhobifcbckaiohandoodkepleif\2.1.7.8_0
CHR Extension: (Little Alchemy) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\knkapnclbofjjgicpkfoagdjohlfjhpd\0.0.15.7_0
CHR Extension: (Parallel Kingdom) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lindbaaodgocnekppljikhgdgedliclg\1_0
CHR Extension: (Fieldrunners) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkpikhjbfbffdblahfidklcohlaeabak\1.0.0.5_0
CHR Extension: (WGT Golf Game) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpedbpkelbhcbkdaglillalioeeekbpb\45.0.0_0
CHR Extension: (Curling) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhalnajmigjnpjpdbpkpgfhekbjmolhp\1.0.10_0
CHR Extension: (DVDVideoSoft) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.2.3.3_1
CHR Extension: (Google Wallet) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (      "name": "MonitorTab") - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ognampngfcbddbfemdapefohjiobgbdl\0.27_0
CHR Extension: (Currently) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhmphdkpgbibohbnpbfiefkgieacjmh\2.7.0_0
CHR Extension: (Yann Arthus-Bertrand) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\plaekpceeonanmjojailaojkconcgofc\3_0
CHR HKLM-x32\...\Chrome\Extension: [aaaanplonkoccjbnlleoidjplmhgeahe] - C:\Users\Markus\AppData\Local\APN\GoogleCRXs\aaaanplonkoccjbnlleoidjplmhgeahe_7.17.6.0.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\Markus\AppData\Local\Google\Chrome\Application\chrome.exe
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1970296 2013-08-26] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635000 2013-08-21] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2562208 2013-10-15] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2942808 2013-10-17] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [695416 2013-08-22] (G Data Software AG)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2012-01-02] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1403208 2010-05-10] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-12-26] ()
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-11-29] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [130392 2013-11-29] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [63320 2013-11-29] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-11-29] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2013-11-29] (G Data Software)
R1 GRD; C:\Windows\SysWow64\drivers\GRD.sys [106224 2011-04-27] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65368 2013-11-29] (G Data Software AG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-12-26] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-03] (Anchorfree Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-30 13:14 - 2013-11-30 13:15 - 00017690 _____ C:\Users\Markus\Downloads\FRST.txt
2013-11-30 13:14 - 2013-11-30 13:14 - 01959032 _____ (Farbar) C:\Users\Markus\Downloads\FRST64.exe
2013-11-30 13:14 - 2013-11-30 13:14 - 00000000 ____D C:\FRST
2013-11-30 13:13 - 2013-11-30 13:13 - 01092065 _____ (Farbar) C:\Users\Markus\Downloads\FRST.exe
2013-11-30 13:12 - 2013-11-30 13:12 - 00000474 _____ C:\Users\Markus\Downloads\defogger_disable.log
2013-11-30 13:12 - 2013-11-30 13:12 - 00000000 _____ C:\Users\Markus\defogger_reenable
2013-11-30 13:11 - 2013-11-30 13:11 - 00050477 _____ C:\Users\Markus\Downloads\Defogger.exe
2013-11-30 10:53 - 2013-11-30 10:53 - 00000000 ____D C:\ProgramData\Oracle
2013-11-30 10:50 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-30 10:49 - 2013-11-30 10:49 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-30 10:49 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-30 10:49 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-30 10:49 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-30 10:45 - 2013-11-30 10:45 - 00915368 _____ (Oracle Corporation) C:\Users\Markus\Downloads\chromeinstall-7u45.exe
2013-11-30 07:19 - 2013-11-30 13:01 - 00000618 _____ C:\Windows\SysWOW64\games.stat
2013-11-29 21:22 - 2013-11-29 21:22 - 00001978 _____ C:\Users\Public\Desktop\G Data InternetSecurity 2014.lnk
2013-11-29 21:06 - 2013-11-29 21:06 - 00461776 _____ C:\Users\Markus\Downloads\Java.exe
2013-11-15 03:01 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 03:01 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 03:01 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 03:01 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 03:01 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 03:01 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 03:01 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-15 03:01 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 03:01 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 03:01 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 03:01 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 03:01 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 07:10 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 07:10 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 07:10 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 07:10 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 07:10 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 07:10 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 07:10 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 07:10 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 07:10 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 07:09 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 07:09 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 07:09 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 07:09 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 07:09 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 07:09 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 07:09 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 07:09 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 07:09 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 07:09 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 07:09 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 07:09 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 07:09 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 07:09 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 07:09 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 07:09 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 07:08 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 07:08 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 07:08 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 07:08 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 07:08 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 21:05 - 2013-11-13 21:10 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build (2).user.js
2013-11-13 20:57 - 2013-11-13 20:57 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build (1).user.js
2013-11-13 20:50 - 2013-11-13 20:50 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build.user.js
2013-11-09 18:02 - 2013-11-09 18:02 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Fatshark
2013-11-09 17:38 - 2013-11-09 17:38 - 06037024 _____ C:\Users\Markus\Downloads\VID-20130815-WA0001.mp4
2013-11-09 17:20 - 2013-11-09 17:20 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

==================== One Month Modified Files and Folders =======

2013-11-30 13:15 - 2013-11-30 13:14 - 00017690 _____ C:\Users\Markus\Downloads\FRST.txt
2013-11-30 13:14 - 2013-11-30 13:14 - 01959032 _____ (Farbar) C:\Users\Markus\Downloads\FRST64.exe
2013-11-30 13:14 - 2013-11-30 13:14 - 00000000 ____D C:\FRST
2013-11-30 13:13 - 2013-11-30 13:13 - 01092065 _____ (Farbar) C:\Users\Markus\Downloads\FRST.exe
2013-11-30 13:12 - 2013-11-30 13:12 - 00000474 _____ C:\Users\Markus\Downloads\defogger_disable.log
2013-11-30 13:12 - 2013-11-30 13:12 - 00000000 _____ C:\Users\Markus\defogger_reenable
2013-11-30 13:12 - 2011-04-22 12:17 - 00000000 ____D C:\Users\Markus
2013-11-30 13:11 - 2013-11-30 13:11 - 00050477 _____ C:\Users\Markus\Downloads\Defogger.exe
2013-11-30 13:06 - 2011-05-14 07:48 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001UA.job
2013-11-30 13:05 - 2009-07-14 05:45 - 00015008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-30 13:05 - 2009-07-14 05:45 - 00015008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-30 13:01 - 2013-11-30 07:19 - 00000618 _____ C:\Windows\SysWOW64\games.stat
2013-11-30 13:01 - 2011-04-22 12:07 - 01532401 _____ C:\Windows\WindowsUpdate.log
2013-11-30 12:59 - 2013-04-05 16:33 - 00000000 ___RD C:\Users\Markus\Google Drive
2013-11-30 12:58 - 2011-06-10 14:50 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-30 12:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-30 12:58 - 2009-07-14 05:51 - 00100032 _____ C:\Windows\setupact.log
2013-11-30 10:56 - 2011-04-22 13:37 - 00562590 _____ C:\Windows\PFRO.log
2013-11-30 10:53 - 2013-11-30 10:53 - 00000000 ____D C:\ProgramData\Oracle
2013-11-30 10:49 - 2013-11-30 10:49 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-30 10:49 - 2012-04-15 08:38 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-30 10:45 - 2013-11-30 10:45 - 00915368 _____ (Oracle Corporation) C:\Users\Markus\Downloads\chromeinstall-7u45.exe
2013-11-30 10:37 - 2012-04-03 23:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-30 10:17 - 2011-06-10 14:50 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-30 09:59 - 2011-09-06 16:04 - 00000000 ____D C:\Users\Markus\Documents\My Games
2013-11-29 22:30 - 2012-06-14 16:32 - 00019016 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2013-11-29 22:30 - 2011-04-23 06:55 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2013-11-29 22:22 - 2011-04-22 13:35 - 00000000 ____D C:\ProgramData\G Data
2013-11-29 21:22 - 2013-11-29 21:22 - 00001978 _____ C:\Users\Public\Desktop\G Data InternetSecurity 2014.lnk
2013-11-29 21:22 - 2012-12-26 21:04 - 00130392 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2013-11-29 21:22 - 2012-12-26 21:04 - 00065368 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2013-11-29 21:22 - 2012-12-26 21:04 - 00064856 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2013-11-29 21:22 - 2012-12-26 21:04 - 00060248 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2013-11-29 21:22 - 2011-04-22 13:36 - 00063320 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2013-11-29 21:06 - 2013-11-29 21:06 - 00461776 _____ C:\Users\Markus\Downloads\Java.exe
2013-11-29 00:20 - 2011-08-21 22:14 - 01224037 _____ C:\Windows\SysWOW64\sig.bin
2013-11-29 00:20 - 2011-08-21 22:14 - 00059612 _____ C:\Windows\SysWOW64\nmp.map
2013-11-24 01:11 - 2011-05-14 07:48 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001Core.job
2013-11-15 20:21 - 2011-07-30 18:03 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2
2013-11-15 20:17 - 2011-04-22 13:28 - 00000000 ____D C:\Users\Markus\AppData\Local\Downloaded Installations
2013-11-15 01:09 - 2011-05-14 07:48 - 00002358 _____ C:\Users\Markus\Desktop\Google Chrome.lnk
2013-11-14 21:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-14 08:16 - 2011-04-22 13:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 08:15 - 2013-08-24 02:00 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 08:13 - 2011-05-21 08:04 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 21:10 - 2013-11-13 21:05 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build (2).user.js
2013-11-13 20:57 - 2013-11-13 20:57 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build (1).user.js
2013-11-13 20:50 - 2013-11-13 20:50 - 00438612 _____ C:\Users\Markus\Downloads\total-conversion-build.user.js
2013-11-11 05:50 - 2011-04-22 12:32 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-09 20:42 - 2011-02-19 22:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-09 18:02 - 2013-11-09 18:02 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Fatshark
2013-11-09 18:01 - 2011-04-22 14:47 - 00379185 _____ C:\Windows\DirectX.log
2013-11-09 17:38 - 2013-11-09 17:38 - 06037024 _____ C:\Users\Markus\Downloads\VID-20130815-WA0001.mp4
2013-11-09 17:20 - 2013-11-09 17:20 - 00000000 ____D C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

Some content of TEMP:
====================
C:\Users\Markus\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 07:49

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-11-2013
Ran by Markus at 2013-11-30 13:16:30
Running from C:\Users\Markus\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: G Data InternetSecurity 2014 (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity 2014 (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Disabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

Adobe AIR (x32 Version: 2.7.0.19530)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Akamai NetSession Interface (HKCU)
Akamai NetSession Interface Service (x32)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Install Manager (Version: 8.0.903.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2012.1219.1521.27485)
AMD Media Foundation Decoders (Version: 1.0.71219.1540)
AMD Steady Video Plug-In  (Version: 2.04.0000)
AMD VISION Engine Control Center (x32 Version: 2012.1219.1521.27485)
ANNO 1503 (x32)
ANNO 2070 (x32 Version: 1.0.0.0)
Ashley Jones – Reise Ins Alte Ägypten (x32 Version: 1.0.0.0)
Ask Toolbar (x32 Version: 1.17.6.0)
ATI AVIVO64 Codecs (Version: 11.6.0.50527)
BrettspielWelt (x32 Version: 1.0)
CacheStats (x32 Version: 3.0.10)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485)
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485)
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485)
CCC Help Czech (x32 Version: 2012.1219.1520.27485)
CCC Help Danish (x32 Version: 2012.1219.1520.27485)
CCC Help Dutch (x32 Version: 2012.1219.1520.27485)
CCC Help English (x32 Version: 2012.1219.1520.27485)
CCC Help Finnish (x32 Version: 2012.1219.1520.27485)
CCC Help French (x32 Version: 2012.1219.1520.27485)
CCC Help German (x32 Version: 2012.1219.1520.27485)
CCC Help Greek (x32 Version: 2012.1219.1520.27485)
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485)
CCC Help Italian (x32 Version: 2012.1219.1520.27485)
CCC Help Japanese (x32 Version: 2012.1219.1520.27485)
CCC Help Korean (x32 Version: 2012.1219.1520.27485)
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485)
CCC Help Polish (x32 Version: 2012.1219.1520.27485)
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485)
CCC Help Russian (x32 Version: 2012.1219.1520.27485)
CCC Help Spanish (x32 Version: 2012.1219.1520.27485)
CCC Help Swedish (x32 Version: 2012.1219.1520.27485)
CCC Help Thai (x32 Version: 2012.1219.1520.27485)
CCC Help Turkish (x32 Version: 2012.1219.1520.27485)
ccc-utility64 (Version: 2012.1219.1521.27485)
CDRWIN 9 (x32 Version: 9.0.12.1116)
Cities XL (x32 Version: 1.0.0)
CivCity (x32 Version: 1.10.0000)
Darkest Hour (x32)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
DeLorme Send To GPS 1.3 (Version: 1.3)
Deutschland Spielt - Spiele Post (x32 Version: 1.0.3.0)
DEUTSCHLAND SPIELT GAME CENTER (x32 Version: 1.0.0.46)
Die Gilde Gold-Edition (x32)
Die Siedler 7 (x32 Version: 1.12.1396)
Die Völker (x32)
DUNGEONS Game of the Year edition (x32 Version: 1.3.3.0)
Fate of the World (x32 Version: 1.1.3.0)
Fate of the World DLC: Denial (x32 Version: 1.1.3.0)
Fate of the World DLC: Migration (x32 Version: 1.1.3.0)
FinePix Studio (x32)
FinePixViewer Resource (x32 Version: 1.2)
FinePixViewer Ver.5.5 (x32 Version: 5.5)
FinePixViewer YTUPL (x32 Version: 1.0)
Free Video Converter V 3.2 (x32 Version: 3.2.0.0)
Free YouTube to MP3 Converter version 3.12.5.628 (x32 Version: 3.12.5.628)
FUSSBALL MANAGER 09 (x32)
FUSSBALL MANAGER 12 (x32 Version: 1.0.0.3)
G Data InternetSecurity 2014 (x32 Version: 24.0.3.4)
GameShadow (x32 Version: 2.02.0000)
GameSpy Arcade (x32)
Garmin Communicator Plugin (x32 Version: 4.0.1)
Garmin Communicator Plugin x64 (Version: 4.0.1)
Garmin USB Drivers (x32 Version: 2.3.0.0)
Geheime Fälle: Vermisst in Rom (x32 Version: 1.0.0.0)
Goin Downtown (x32 Version: 1.00.0000)
Google Chrome (HKCU Version: 31.0.1650.57)
Google Drive (x32 Version: 1.12.5329.1887)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Google+ RegHelper (x32 Version: 1.2.0)
Gothic 3 (x32 Version: 1.0.0)
Hotel Gigant (x32)
HydraVision (x32 Version: 4.2.166.0)
Jane Angel (x32 Version: 1.0.0.0)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
Java(TM) 6 Update 5 (x32 Version: 1.6.0.50)
King’s Bounty – Gold Edition (x32)
Krater (x32)
Landwirtschafts Gigant (x32)
Luxor Evolved (x32 Version: 1.0.0.0)
Medieval II Total War (x32 Version: 1.03.000)
Medieval II Total War : Kingdoms : Americas (x32 Version: 1.03.000)
Medieval II Total War : Kingdoms : Britannia (x32 Version: 1.03.000)
Medieval II Total War : Kingdoms : Crusades (x32 Version: 1.03.000)
Medieval II Total War : Kingdoms : Teutonic (x32 Version: 1.03.000)
Mein Gartenparadies: Frühlingserwachen (x32 Version: 1.0.0.0)
Meine Boutique 2 (x32 Version: 1.0.0.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
Monopoly Tycoon (x32)
Moorhuhn Remake (x32 Version: 1.00.0000)
Moorhuhn WE AYCS (x32)
Mount&Blade (x32)
MyTomTom 3.2.0.1055 (x32 Version: 3.2.0.1055)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA PhysX (x32 Version: 9.09.0428)
Pando Media Booster (x32 Version: 2.6.0.8)
Patrizier 4 (x32 Version: 1.3.0)
Pride of Nations Patch 1.01 (x32)
ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14)
Questpaket 4 Update 1 Deinstallation (x32 Version: 4.1.0.0)
QuickTime Alternative 3.2.2 (x32 Version: 3.2.2)
Railroad Tycoon 3 (x32 Version: 1.0)
Ravensburger tiptoi (x32)
Risen (x32 Version: 1.00.0000)
Risen Hotfix 1.01 (x32 Version: 1.01)
Rising Kingdoms (x32)
Ritter Arthur II - Collectors Edition (x32 Version: 1.0.0.0)
Samsung_MonSetup (x32 Version: 1.00.0000)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
Sid Meier's Civilization IV Colonization (x32 Version: 1.01)
Sid Meier's Pirates! (x32 Version: 2.00.0000)
Silent Hunter 5 (x32 Version: 1.2.0)
Skype Click to Call (x32 Version: 6.3.11079)
Skype™ 5.10 (x32 Version: 5.10.116)
Space Empires V (x32)
Starcraft (x32)
Steam (x32 Version: 1.0.0.0)
Stronghold (x32 Version: 1.20.0000)
Support.com Toolbar Updater (HKCU Version: 1.4.3.42067)
Supreme Ruler 2010 4.6 Update (x32)
The Witcher Enhanced Edition (x32 Version: 1.4.5.1280)
TomTom HOME (x32 Version: 2.9.7)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
TuneUp Utilities (x32 Version: 9.0.4100.36)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.4100.36)
Ubisoft Game Launcher (x32 Version: 1.0.0.0)
Unity Web Player (HKCU Version: )
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
Wildlife Park 3 v1.11 (x32)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Mobile Device Center Driver Update (Version: 6.1.6965.0)
Windows Mobile®-Gerätehandbuch (x32 Version: 1.0)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
X3: Reunion v2.0.02 (x32)

==================== Restore Points  =========================

15-11-2013 02:00:17 Windows Update
15-11-2013 19:19:24 Installed TomTom HOME.
21-11-2013 06:19:21 Windows Update
26-11-2013 06:24:45 Windows Update
29-11-2013 07:41:58 Windows Update
30-11-2013 09:48:07 Installed Java 7 Update 45

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0D8727C8-3EA0-42F1-AD1F-CB423B4059BB} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {115FB772-EE43-4365-9FC7-D33D0CC326E3} - System32\Tasks\{D5932EFC-E0CB-444D-A93B-B80BCF711CA0} => C:\Users\Markus\Downloads\KOLUMBUS\GO.EXE [1994-01-27] ()
Task: {1D5C4FFA-259A-470D-A881-E9E1311B16E7} - System32\Tasks\Google Updater and Installer => C:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-14] (Google Inc.)
Task: {31A846D1-1C3D-4584-8F3C-E9DF2406DA21} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {350B48F2-0E8C-43F1-9938-663EFD3D28BE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {358EDC79-A36C-456A-91C0-429AC7828561} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe [2010-05-10] (TuneUp Software)
Task: {3EAB480A-0F54-4C27-8BDA-910D8D65F7CB} - System32\Tasks\{B00458A4-C621-4AC1-A577-3CC27AA00623} => C:\Users\Markus\Downloads\KOLUMBUS\GO.EXE [1994-01-27] ()
Task: {4DFFE235-E6E1-444E-AC33-9FE7EA691A8F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5AF87E27-A9CF-47BB-B495-9C8449AA47C2} - System32\Tasks\{E39C9F8A-9D7B-44A9-BA98-3C9BC3134CBC} => C:\Program Files (x86)\DATA BECKER\America Gold Edition\America.exe
Task: {6A3151DC-3AC2-4E8B-AA05-49875B26A538} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {6BE83B15-0040-4754-834D-236195241637} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001Core => C:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-14] (Google Inc.)
Task: {73E8CA7F-3975-46F5-B450-52A6A1384935} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001UA => C:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-14] (Google Inc.)
Task: {93E78EDF-DF77-48BF-BC48-FAEDCC362472} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {AC5F909E-14E9-4426-A127-FB3F8D5F5AB1} - System32\Tasks\{8F6C53A8-78DF-4643-9B26-D6C06FD0C572} => C:\Program Files (x86)\DATA BECKER\America Gold Edition\America.exe
Task: {D08E9D06-02DB-4C7C-BDE0-3FC7425B3630} - System32\Tasks\{00F8E4A0-E286-4818-BEF9-844F5C1B74A3} => E:\Setup.exe [2012-03-15] (Valve Corporation)
Task: {D2D499A3-DF21-4BBC-9579-9DF8947BD53D} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-01] ()
Task: {EBEA745E-151A-4029-8576-D61D676D46B2} - System32\Tasks\{FA7A1E1A-DB65-4F05-B61A-731A1AA83AE2} => E:\Setup\Setup.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001Core.job => C:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1422310105-22800220-548169932-1001UA.job => C:\Users\Markus\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-12-19 15:32 - 2012-12-19 15:32 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-04-17 10:02 - 2013-04-17 10:02 - 00026040 _____ () C:\Program Files (x86)\MyTomTom 3\DeviceDetection.dll
2013-04-17 10:02 - 2013-04-17 10:02 - 00074168 _____ () C:\Program Files (x86)\MyTomTom 3\TomTomSupporterBase.dll
2013-04-17 10:02 - 2013-04-17 10:02 - 00279480 _____ () C:\Program Files (x86)\MyTomTom 3\TomTomSupporterProxy.dll
2012-09-09 09:30 - 2007-02-16 19:01 - 00081920 _____ () C:\Program Files (x86)\FinePixViewer\wia_register_event.dll
2013-11-15 01:09 - 2013-11-14 12:28 - 00702416 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll
2013-11-15 01:09 - 2013-11-14 12:28 - 00099792 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll
2013-11-15 01:09 - 2013-11-14 12:29 - 04055504 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
2013-11-15 01:09 - 2013-11-14 12:29 - 00399312 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
2013-11-15 01:09 - 2013-11-14 12:28 - 01619408 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll
2013-11-30 12:58 - 2013-11-30 12:58 - 00098816 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32api.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00110080 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\pywintypes27.dll
2013-11-30 12:58 - 2013-11-30 12:58 - 00364544 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\pythoncom27.dll
2013-11-30 12:58 - 2013-11-30 12:58 - 00044032 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_socket.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 01153024 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_ssl.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00320512 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32com.shell.shell.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00711680 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_hashlib.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 01175040 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._core_.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00805888 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._gdi_.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00811008 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._windows_.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 01062400 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._controls_.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00735232 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._misc_.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00128512 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_elementtree.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00127488 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\pyexpat.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00557056 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\pysqlite2._sqlite.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00087040 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_ctypes.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00119808 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32file.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00108544 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32security.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00018432 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32event.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00038912 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32inet.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00122368 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._wizard.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00686080 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\unicodedata.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00026624 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\_multiprocessing.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00070656 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\wx._html2.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00010240 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\select.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00025600 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32pdh.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00504832 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\windows._cacheinvalidation.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00011264 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32crypt.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00035840 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32process.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00017408 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32profile.pyd
2013-11-30 12:58 - 2013-11-30 12:58 - 00022528 _____ () C:\Users\Markus\AppData\Local\Temp\_MEI28282\win32ts.pyd
2013-11-29 13:19 - 2013-11-29 13:19 - 00358400 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.5.3_0\plugins\screen_capture.dll
2013-11-15 01:09 - 2013-11-14 12:29 - 13582800 _____ () C:\Users\Markus\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/30/2013 07:20:46 AM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/25/2013 00:46:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: OneClick.exe, Version: 9.0.4100.36, Zeitstempel: 0x4be7eab5
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002dfe4
ID des fehlerhaften Prozesses: 0x24bc
Startzeit der fehlerhaften Anwendung: 0xOneClick.exe0
Pfad der fehlerhaften Anwendung: OneClick.exe1
Pfad des fehlerhaften Moduls: OneClick.exe2
Berichtskennung: OneClick.exe3

Error: (11/24/2013 11:24:57 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_SysMain, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: sysmain.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c9db
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000404ac
ID des fehlerhaften Prozesses: 0x79c
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_SysMain0
Pfad der fehlerhaften Anwendung: svchost.exe_SysMain1
Pfad des fehlerhaften Moduls: svchost.exe_SysMain2
Berichtskennung: svchost.exe_SysMain3

Error: (11/22/2013 01:08:26 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AVKProxy.exe, Version: 1.5.12333.289, Zeitstempel: 0x50b6db57
Name des fehlerhaften Moduls: AVKBap32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4f221ee8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x726f3d6a
ID des fehlerhaften Prozesses: 0x2b24
Startzeit der fehlerhaften Anwendung: 0xAVKProxy.exe0
Pfad der fehlerhaften Anwendung: AVKProxy.exe1
Pfad des fehlerhaften Moduls: AVKProxy.exe2
Berichtskennung: AVKProxy.exe3

Error: (11/22/2013 01:07:45 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AVKProxy.exe, Version: 1.5.12333.289, Zeitstempel: 0x50b6db57
Name des fehlerhaften Moduls: AVKBap32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4f221ee8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72713e90
ID des fehlerhaften Prozesses: 0x2b24
Startzeit der fehlerhaften Anwendung: 0xAVKProxy.exe0
Pfad der fehlerhaften Anwendung: AVKProxy.exe1
Pfad des fehlerhaften Moduls: AVKProxy.exe2
Berichtskennung: AVKProxy.exe3

Error: (11/22/2013 03:01:48 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_SysMain, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: sysmain.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c9db
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000461f6
ID des fehlerhaften Prozesses: 0x780
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_SysMain0
Pfad der fehlerhaften Anwendung: svchost.exe_SysMain1
Pfad des fehlerhaften Moduls: svchost.exe_SysMain2
Berichtskennung: svchost.exe_SysMain3

Error: (11/21/2013 07:16:28 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AVKProxy.exe, Version: 1.5.12333.289, Zeitstempel: 0x50b6db57
Name des fehlerhaften Moduls: AVKBap32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4f221ee8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x726f3d6a
ID des fehlerhaften Prozesses: 0x65c
Startzeit der fehlerhaften Anwendung: 0xAVKProxy.exe0
Pfad der fehlerhaften Anwendung: AVKProxy.exe1
Pfad des fehlerhaften Moduls: AVKProxy.exe2
Berichtskennung: AVKProxy.exe3

Error: (11/21/2013 07:14:35 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AVKProxy.exe, Version: 1.5.12333.289, Zeitstempel: 0x50b6db57
Name des fehlerhaften Moduls: AVKBap32.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4f221ee8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72713e90
ID des fehlerhaften Prozesses: 0x65c
Startzeit der fehlerhaften Anwendung: 0xAVKProxy.exe0
Pfad der fehlerhaften Anwendung: AVKProxy.exe1
Pfad des fehlerhaften Moduls: AVKProxy.exe2
Berichtskennung: AVKProxy.exe3

Error: (11/21/2013 07:02:42 AM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/16/2013 04:57:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: OneClick.exe, Version: 9.0.4100.36, Zeitstempel: 0x4be7eab5
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002dfe4
ID des fehlerhaften Prozesses: 0x2348
Startzeit der fehlerhaften Anwendung: 0xOneClick.exe0
Pfad der fehlerhaften Anwendung: OneClick.exe1
Pfad des fehlerhaften Moduls: OneClick.exe2
Berichtskennung: OneClick.exe3


System errors:
=============
Error: (11/30/2013 00:58:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/30/2013 10:56:25 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/30/2013 07:19:11 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 10:24:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 09:25:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 04:36:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 08:36:47 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/29/2013 00:49:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "G Data Personal Firewall" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (11/29/2013 00:49:52 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst G Data Personal Firewall erreicht.

Error: (11/29/2013 00:49:52 AM) (Source: DCOM) (User: )
Description: 1053GDFwSvc-Service{1DED95CA-C567-464A-B405-087EDDF0B095}


Microsoft Office Sessions:
=========================
Error: (11/30/2013 07:20:46 AM) (Source: MsiInstaller)(User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/25/2013 00:46:25 PM) (Source: Application Error)(User: )
Description: OneClick.exe9.0.4100.364be7eab5ntdll.dll6.1.7601.18247521ea8e7c00000050002dfe424bc01cee9ce05117cd0C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exeC:\Windows\SysWOW64\ntdll.dll35d63350-55c7-11e3-b16d-bcaec5ab34c4

Error: (11/24/2013 11:24:57 AM) (Source: Application Error)(User: )
Description: svchost.exe_SysMain6.1.7600.163854a5bc3c1sysmain.dll6.1.7601.175144ce7c9dbc000000500000000000404ac79c01cee8f00fb39ee0C:\Windows\system32\svchost.exec:\windows\system32\sysmain.dllaa2bc1a0-54f2-11e3-a14e-bcaec5ab34c4

Error: (11/22/2013 01:08:26 PM) (Source: Application Error)(User: )
Description: AVKProxy.exe1.5.12333.28950b6db57AVKBap32.dll_unloaded0.0.0.04f221ee8c0000005726f3d6a2b2401cee681950e8710C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exeAVKBap32.dllc9ecbc90-536e-11e3-a5b5-bcaec5ab34c4

Error: (11/22/2013 01:07:45 PM) (Source: Application Error)(User: )
Description: AVKProxy.exe1.5.12333.28950b6db57AVKBap32.dll_unloaded0.0.0.04f221ee8c000000572713e902b2401cee681950e8710C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exeAVKBap32.dllb1981950-536e-11e3-a5b5-bcaec5ab34c4

Error: (11/22/2013 03:01:48 AM) (Source: Application Error)(User: )
Description: svchost.exe_SysMain6.1.7600.163854a5bc3c1sysmain.dll6.1.7601.175144ce7c9dbc000000500000000000461f678001cee67f07201060C:\Windows\system32\svchost.exec:\windows\system32\sysmain.dll0b7e79a0-531a-11e3-a5b5-bcaec5ab34c4

Error: (11/21/2013 07:16:28 AM) (Source: Application Error)(User: )
Description: AVKProxy.exe1.5.12333.28950b6db57AVKBap32.dll_unloaded0.0.0.04f221ee8c0000005726f3d6a65c01cee67f06af2620C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exeAVKBap32.dll747cd970-5274-11e3-a5b5-bcaec5ab34c4

Error: (11/21/2013 07:14:35 AM) (Source: Application Error)(User: )
Description: AVKProxy.exe1.5.12333.28950b6db57AVKBap32.dll_unloaded0.0.0.04f221ee8c000000572713e9065c01cee67f06af2620C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exeAVKBap32.dll3103e670-5274-11e3-a5b5-bcaec5ab34c4

Error: (11/21/2013 07:02:42 AM) (Source: MsiInstaller)(User: NT-AUTORITÄT)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/16/2013 04:57:30 PM) (Source: Application Error)(User: )
Description: OneClick.exe9.0.4100.364be7eab5ntdll.dll6.1.7601.18247521ea8e7c00000050002dfe4234801cee2e34627e3e0C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exeC:\Windows\SysWOW64\ntdll.dllcba871a0-4ed7-11e3-8bde-bcaec5ab34c4


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 4095.23 MB
Available physical RAM: 2221.29 MB
Total Pagefile: 8188.63 MB
Available Pagefile: 5306.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:785.03 GB) (Free:542.3 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Volume) (Fixed) (Total:146.48 GB) (Free:136.14 GB) NTFS
Drive e: (KRATER_GOLDMASTER) (CDROM) (Total:1.78 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 00010FB2)
Partition 1: (Active) - (Size=785 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=146 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-30 13:26:47
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000063 Hitachi_ rev.JP4O 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Markus\AppData\Local\Temp\pwdiypoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                         fffff80002fb1000 36 bytes [05, FD, FF, FF, E9, 51, D0, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 565                                                                         fffff80002fb1025 45 bytes [8B, 0C, 00, 85, C9, 0F, 84, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\SysWOW64\svchost.exe[1528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                              00000000755b1465 2 bytes [5B, 75]
.text     C:\Windows\SysWOW64\svchost.exe[1528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                             00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      00000000755b1465 2 bytes [5B, 75]
.text     C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe[2796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      00000000755b1465 2 bytes [5B, 75]
.text     C:\Users\Markus\AppData\Local\Akamai\netsession_win.exe[2796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000755b1465 2 bytes [5B, 75]
.text     C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           00000000755b1465 2 bytes [5B, 75]
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Program Files (x86)\Google\Drive\googledrivesync.exe[4696] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                      00000000755b1465 2 bytes [5B, 75]
.text     C:\Program Files (x86)\Google\Drive\googledrivesync.exe[4696] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                     00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2
.text     C:\Users\Markus\Downloads\Defogger.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                       00000000755b1465 2 bytes [5B, 75]
.text     C:\Users\Markus\Downloads\Defogger.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                      00000000755b14bb 2 bytes [5B, 75]
.text     ...                                                                                                                                        * 2

---- Threads - GMER 2.1 ----

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3144:208]                                                                              000007fefb682a7c
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3144:3396]                                                                             000007feebe9d618
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3144:2848]                                                                             000007fef9165124
Thread    C:\Windows\System32\svchost.exe [360:5044]                                                                                                 000007fee8169688

---- EOF - GMER 2.1 ----