Windows 8.1 64bit - PC Optimizer Pro und SpyHunter4

dotDuke · 13.01.2014, 21:29

Guten Abend werte Trojaner-Board-Mitglieder,

ich habe es geschafft durch Installation einer Software(SUMo von der Seite chip.de) durch unerwünschten Beifang die Malware "PC Optimizer Pro" auf meinen PC zu bekommen. In meiner Naivität habe ich dann gleich einem der ersten Beiträge die Google ausspuckte vertraut und die Software "SpyHunter4" her runtergeladen...
Heute bin ich wohl kein schlauer Mensch

Dem Thread "Für alle Hilfesuchenden" folgend kommen hier die log-Dateien der 3 Schritte.
Ich hoffe jemand kann mir helfen.

Mit freundlichen Grüßen

Defogger

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:10 on 13/01/2014 (Axel)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-01-2014 02
Ran by Axel (administrator) on DUKE-PC on 13-01-2014 21:10:32
Running from C:\Users\Axel\Desktop
Windows 8.1 Pro with Media Center (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) D:\Prgramme\Sandboxie\SbieSvc.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(DTS) C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(LogMeIn Inc.) D:\Prgramme\Hamachi\hamachi-2.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Spotify Ltd) C:\Users\Axel\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Flux Software LLC) C:\Users\Axel\AppData\Local\FluxSoftware\Flux\flux.exe
(RaMMicHaeL) C:\Users\Axel\AppData\Roaming\7+ Taskbar Tweaker\7+ Taskbar Tweaker.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Opera Software) C:\Program Files\Opera x64\opera.exe
(Opera Software) C:\Program Files\Opera x64\pluginwrapper\opera_plugin_wrapper.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) \\?\C:\WINDOWS\system32\wbem\WMIADAP.EXE


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7158344 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [IntelliType Pro] - C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4956176 2013-11-07] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2010624 2013-07-20] (Dominik Reichl)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - D:\Prgramme\Hamachi\hamachi-2-ui.exe [3806544 2013-11-29] (LogMeIn Inc.)
HKLM-x32\...\Runonce: [kcsoftwareskcep] -  [x]
HKCU\...\Run: [Steam] - G:\Steam\steam.exe [1815464 2014-01-07] (Valve Corporation)
HKCU\...\Run: [SandboxieControl] - D:\Prgramme\Sandboxie\SbieCtrl.exe [759496 2013-10-16] (Sandboxie Holdings, LLC)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Google Update] - C:\Users\Axel\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-10] (Google Inc.)
HKCU\...\Run: [Battle.net] - E:\Battle.net\Battle.net Launcher.exe [2555440 2013-12-20] (Blizzard Entertainment)
HKCU\...\Run: [Spotify] - C:\Users\Axel\AppData\Roaming\Spotify\Spotify.exe [5951488 2013-12-07] (Spotify Ltd)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Axel\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-12-07] (Spotify Ltd)
HKCU\...\Run: [f.lux] - C:\Users\Axel\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKCU\...\Run: [7 Taskbar Tweaker] - C:\Users\Axel\AppData\Roaming\7+ Taskbar Tweaker\7+ Taskbar Tweaker.exe [337920 2014-01-05] (RaMMicHaeL)
HKU\Mucky\...\Run: [GoogleChromeAutoLaunch_2988A9A4A01A675D6F2B4D8E35E1547F] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184 2013-12-04] (Google Inc.)
HKU\Mucky\...\Run: [SandboxieControl] - D:\Prgramme\Sandboxie\SbieCtrl.exe [759496 2013-10-16] (Sandboxie Holdings, LLC)
AppInit_DLLs:   [ ] ()
AppInit_DLLs-x32:   [ ] ()
Startup: C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Axel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x37B2001ED2EDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE,de;q=0.5
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{17097B45-E3D8-4010-8DA7-67017EABFC00}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Tcpip\..\Interfaces\{504772BB-49E8-4351-9023-81DFADB2CE77}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Tcpip\..\Interfaces\{CD2C2C33-0C09-441E-B353-85F9B3CA3AC7}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

Chrome: 
=======
CHR HomePage: 
CHR RestoreOnStartup: "sync": {
      "acknowledged_types": [ "Bookmarks", "Preferences", "Passwords", "Autofill Profiles", "Autofill", "Themes", "Typed URLs", "Extensions", "Search Engines", "Sessions", "Apps", "App settings", "Extension settings", "App Notifications", "Encryption keys" ],
      "app_notifications": true,
      "app_settings": true,
      "apps": true,
      "autofill": true,
      "autofill_profile": true,
      "bookmarks": true,
      "dictionary": true,
      "encryption_bootstrap_token": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA/yCA3fsHvkGO75urjBTvmAAAAAACAAAAAAAQZgAAAAEAACAAAADODmP9P8saSvRT1OiKQDqL/Qna9hXOeG++xaRJi3bFUQAAAAAOgAAAAAIAACAAAADopGrFNPh8DMOodEiRkAfr2rgflwM06b0HfeABOVLwF0AAAADqt/04OXsCBXEHwubzpQ9yc7j72f6zhLSab9vsTyI0D6ou23oqUk0RImVhArpfNYFsVDTHkxq8aSK9l3lkkxARQAAAAGXUkPYxDqqZk5il8dzP/CCu7x8ZKJbQ7GWP8IMyuEgkzU9gFooDfKpThjiLalN0dXslXsslCH7DAwP2JI8BkTE=",
      "extension_settings": true,
      "extensions": true,
      "favicon_images": true,
      "favicon_tracking": true,
      "favicons_syncing_enabled": true,
      "has_setup_completed": true,
      "history_delete_directives": true,
      "keep_everything_synced": true,
      "keystore_encryption_bootstrap_token": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAne9Sa5mY7EGq3JRii97RBgAAAAACAAAAAAAQZgAAAAEAACAAAAA5SZ5C/3bxrr595tNePVQER4wdtKNcDN61AJa1MX7BwAAAAAAOgAAAAAIAACAAAADmMVHgcfDXOnmblv4KLule6ZWTWFyVRp0JwL65A23F+lAAAADLstzHple80bEw07IxWC/CXWauydo7Y4+Mr2pD7cpj11EUZFiqgsUfym9lgma9Nwh7cV3wJJb5NOr9PBapWLEpM0+JEMX+z8QXJ+6DbvpiSUAAAAAkw4fzCV6Tc92U5g7JGavQRNFzP/JV/w3eyTsAuXu7pDq+IdKKQjcF/OV7XSUgg2zPlnEASX4G0+9et6a9vWUh",
      "last_synced_time": "13034115758248412",
      "passwords": true,
      "preferences": true,
      "priority_preferences": true,
      "search_engines": true,
      "session_sync_guid": "session_syncXs8FMp+EeeIIFyFxomevBA==",
      "sessions": true,
      "suppress_start": false,
      "synced_notifications": true,
      "tabs": true,
      "themes": true,
      "typed_urls"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
CHR Extension: (Google Tasks) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\allibancfngcpjmjnnboebggipbaalhn\1.0_0 [2012-11-06]
CHR Extension: (Google Docs) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 [2013-01-31]
CHR Extension: (Google Drive) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2012-11-21]
CHR Extension: (YouTube Options) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdokagampppgbnjfdlkfpphniapiiifn\1.8.150_0 [2013-12-24]
CHR Extension: (YouTube) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2013-04-14]
CHR Extension: (Spotify - Music for every moment) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnkjkdjlofllcpbemipjbcpfnglbgieh\0.2.3_0 [2013-07-22]
CHR Extension: (Google Search) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2013-03-28]
CHR Extension: (Google+) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlppkpafhbajpcmmoheippocdidnckmm\1.2.0.418_0 [2013-12-03]
CHR Extension: (Google Calendar) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0 [2012-11-06]
CHR Extension: (PanicButton) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\faminaibgiklngmfpfbhmokfmnglamcm\0.14.2.2_0 [2012-11-06]
CHR Extension: (Springpad) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0 [2013-03-27]
CHR Extension: (HTTPS Everywhere) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp\2014.1.3_0 [2014-01-05]
CHR Extension: (AdBlock) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0 [2013-12-01]
CHR Extension: (Feedly - News, Blogs and Youtube) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob\18.2_0 [2013-12-14]
CHR Extension: (AirDroid) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkgndiocipalkpejnpafdbdlfdjihomd\2.0.4_0 [2013-08-23]
CHR Extension: (Google Keep) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki\2.0.14025.1345_0 [2014-01-12]
CHR Extension: (Chrome to Mobile) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\3.1_0 [2013-12-11]
CHR Extension: (Stealthy) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje\3.0.1_0 [2013-02-23]
CHR Extension: (Speed Dial 2) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpfpebmajhhopeonhlcgidhclcccjcik\1.7.5_0 [2013-12-08]
CHR Extension: (Gestures for Google Chrome\u2122) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpkfjicglakibpenojifdiepckckakgk\1.13.4_0 [2013-06-22]
CHR Extension: (Evernote Web) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0 [2013-10-09]
CHR Extension: (MyPermissions Cleaner) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\liiikhhbkpmpomjmdofandjmdgapiahi\1.3.9_0 [2014-01-12]
CHR Extension: (Hangouts) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd\2013.1211.433.2_0 [2013-12-19]
CHR Extension: (Google Wallet) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-19]
CHR Extension: (Greyscale) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\penkfbldfkaelnnhblmfmajlggdielfm\1.0_0 [2012-11-06]
CHR Extension: (Evernote Web Clipper) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\6.0.8_0 [2013-12-31]
CHR Extension: (Gmail) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 [2012-11-06]
CHR Extension: (Google Similar Pages beta (by Google)) - C:\Users\Axel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjnfggphgdjblhfjaphkjhfpiiekbbej\0.5.5.1_0 [2012-11-06]

==================== Services (Whitelisted) =================

U2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
U2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.)
U2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
U2 DTSAudioService; C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe [210024 2000-01-01] (DTS)
U2 EvtSys; C:\Windows\System32\evtsys.exe [137728 2012-12-20] (Rochester Institute of Technology)
U2 Hamachi2Svc; D:\Prgramme\Hamachi\hamachi-2.exe [2210640 2013-11-29] (LogMeIn Inc.)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2000-01-01] (Intel Corporation)
U2 SbieSvc; D:\Prgramme\Sandboxie\SbieSvc.exe [186056 2013-10-16] (Sandboxie Holdings, LLC)
U3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
U3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [104184 2012-12-21] (Advanced Micro Devices)
U0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
U1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-05] (AVG Technologies CZ, s.r.o.)
U1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [240920 2013-11-04] (AVG Technologies CZ, s.r.o.)
U0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [194872 2013-10-24] (AVG Technologies CZ, s.r.o.)
U1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
U0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
U0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
U0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
U1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [252728 2013-10-21] (AVG Technologies CZ, s.r.o.)
U3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
U3 hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2013-11-29] (LogMeIn Inc.)
U3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
U3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
U0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
U0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
U3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-09-30] (Microsoft Corporation)
U0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
U3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
U3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
U3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
U3 SbieDrv; D:\Prgramme\Sandboxie\SbieDrv.sys [200552 2013-10-16] (Sandboxie Holdings, LLC)
U3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
U0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
U3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
U3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2013-08-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-13 21:10 - 2014-01-13 21:10 - 00019162 _____ C:\Users\Axel\Desktop\FRST.txt
2014-01-13 21:10 - 2014-01-13 21:10 - 00000470 _____ C:\Users\Axel\Desktop\defogger_disable.log
2014-01-13 21:10 - 2014-01-13 21:10 - 00000000 ____D C:\FRST
2014-01-13 21:10 - 2014-01-13 21:10 - 00000000 _____ C:\Users\Axel\defogger_reenable
2014-01-13 21:09 - 2014-01-13 21:09 - 00050477 _____ C:\Users\Axel\Desktop\Defogger.exe
2014-01-13 21:09 - 2014-01-13 21:07 - 02075648 _____ (Farbar) C:\Users\Axel\Desktop\FRST64.exe
2014-01-13 21:09 - 2014-01-13 21:07 - 00377856 _____ C:\Users\Axel\Desktop\21nwygg6.exe
2014-01-13 20:48 - 2014-01-13 20:48 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-13 20:48 - 2014-01-13 20:48 - 00000000 _____ C:\autoexec.bat
2014-01-13 20:47 - 2014-01-13 21:02 - 00000000 ____D C:\WINDOWS\CD09642E061D4844BA37ED1480916404.TMP
2014-01-13 20:39 - 2014-01-13 20:39 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2014-01-13 20:39 - 2014-01-13 20:39 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2014-01-13 20:34 - 2014-01-13 20:34 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Axel\Downloads\SpyHunter-Installer.exe
2014-01-13 20:30 - 2014-01-13 20:30 - 00000000 ____D C:\Users\Axel\Documents\Optimizer Pro
2014-01-12 12:21 - 2014-01-12 12:21 - 00000000 ____D C:\Users\Axel\Documents\Elder Scrolls Online
2014-01-12 12:21 - 2014-01-12 12:21 - 00000000 ____D C:\ProgramData\Elder Scrolls Online
2014-01-08 18:26 - 2014-01-08 18:26 - 00000684 _____ C:\Users\Axel\Desktop\The Elder Scrolls Online Beta.lnk
2014-01-08 17:04 - 2014-01-08 17:27 - 55903624 _____ (                                                            ) C:\Users\Axel\Downloads\Install_ESO_Beta.exe
2014-01-07 18:43 - 2014-01-07 18:43 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-01-06 19:05 - 2014-01-06 19:05 - 00000000 ____D C:\Users\Axel\AppData\Local\LogMeIn
2014-01-06 19:05 - 2014-01-06 19:05 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-05 20:15 - 2014-01-12 19:57 - 00000000 ____D C:\Users\Axel\AppData\Local\LogMeIn Hamachi
2014-01-05 20:14 - 2014-01-05 20:14 - 06373376 _____ C:\Users\Axel\Downloads\hamachi09.msi
2014-01-05 15:27 - 2014-01-05 15:27 - 00000589 _____ C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\putty_0.63.lnk
2014-01-04 19:31 - 2014-01-04 19:31 - 00000000 ____D C:\Users\Axel\Documents\CS50
2014-01-04 15:05 - 2014-01-04 15:05 - 00025764 _____ C:\Users\Axel\Downloads\Jahresbericht 2012.odt
2014-01-04 00:03 - 2014-01-04 00:04 - 00000000 ____D C:\Users\Axel\Downloads\MY WALLPAPER COLLECTION
2014-01-03 23:43 - 2014-01-04 00:02 - 728991017 _____ C:\Users\Axel\Downloads\MY WALLPAPER COLLECTION.zip
2014-01-01 21:22 - 2014-01-01 21:22 - 00000600 _____ C:\Users\Axel\AppData\Roaming\winscp.rnd
2014-01-01 21:21 - 2014-01-12 22:27 - 00000600 _____ C:\Users\Axel\AppData\Local\PUTTY.RND
2014-01-01 21:21 - 2014-01-01 21:21 - 00000995 _____ C:\Users\Public\Desktop\WinSCP.lnk
2014-01-01 21:21 - 2014-01-01 21:21 - 00000000 ____D C:\Program Files (x86)\WinSCP
2014-01-01 21:20 - 2014-01-01 21:20 - 05132128 _____ (Martin Prikryl                                              ) C:\Users\Axel\Downloads\winscp550setup.exe
2013-12-29 14:30 - 2013-12-29 14:30 - 02356494 _____ C:\Users\Axel\Downloads\Enigma4Patch1 (1).rmskin
2013-12-29 14:29 - 2013-12-29 14:30 - 03066102 _____ C:\Users\Axel\Downloads\rainmeter___elegance_2_by_lilshizzy-d41hrge.rmskin
2013-12-29 14:29 - 2013-12-29 14:29 - 02356494 _____ C:\Users\Axel\Downloads\Enigma4Patch1.rmskin
2013-12-29 14:29 - 2013-12-29 14:29 - 00430298 _____ C:\Users\Axel\Downloads\Animus-BlackRoom vr.1.2.rmskin
2013-12-29 14:28 - 2013-12-29 14:28 - 00439467 _____ C:\Users\Axel\Downloads\bar_top_by_serjsilva-d4jcuw9.rmskin
2013-12-22 12:51 - 2013-12-22 12:51 - 00281304 _____ C:\WINDOWS\Minidump\122213-38718-01.dmp
2013-12-19 18:38 - 2013-12-19 18:38 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2013-12-19 18:38 - 2013-12-19 18:38 - 00000000 ____D C:\Users\Axel\AppData\Local\FluxSoftware
2013-12-19 17:43 - 2013-12-19 17:43 - 00597304 _____ C:\Users\Axel\Downloads\flux-setup.exe
2013-12-19 17:37 - 2013-12-19 17:37 - 00000000 ____D C:\Users\Axel\AppData\Roaming\7+ Taskbar Tweaker
2013-12-19 17:36 - 2013-12-19 17:36 - 01139416 _____ (RaMMicHaeL) C:\Users\Axel\Downloads\7tt_setup.exe
2013-12-19 17:32 - 2013-12-19 17:34 - 17696720 _____ (Google Inc.) C:\Users\Axel\Downloads\picasa39-setup.exe
2013-12-19 02:56 - 2013-12-19 02:56 - 04558848 _____ (Google Inc.) C:\WINDOWS\SysWOW64\GPhotos.scr
2013-12-17 18:03 - 2013-12-17 18:03 - 00281304 _____ C:\WINDOWS\Minidump\121713-39656-01.dmp
2013-12-15 14:25 - 2013-12-15 14:25 - 17154196 _____ C:\Users\Axel\Downloads\simplesentencethree_by_white_baron-d2ws62q.zip
2013-12-15 12:51 - 2013-12-15 12:51 - 00000000 ____D C:\Users\Axel\Downloads\Pulse_0.6.7.3
2013-12-14 08:56 - 2013-11-12 00:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-14 08:56 - 2013-11-12 00:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-12-14 08:56 - 2013-11-12 00:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-12-14 08:56 - 2013-11-12 00:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-12-14 08:56 - 2013-11-11 03:48 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2013-12-14 08:56 - 2013-11-09 12:55 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2013-12-14 08:56 - 2013-11-09 07:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
2013-12-14 08:56 - 2013-11-09 06:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
2013-12-14 08:56 - 2013-11-08 11:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2013-12-14 08:56 - 2013-11-08 06:23 - 00449024 _____ (Microsoft Corporation) C:\WINDOWS\system32\appmgr.dll
2013-12-14 08:56 - 2013-11-08 05:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2013-12-14 08:56 - 2013-11-08 05:42 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appmgr.dll
2013-12-14 08:56 - 2013-11-08 05:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2013-12-14 08:56 - 2013-11-08 05:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2013-12-14 08:56 - 2013-11-08 05:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2013-12-14 08:56 - 2013-11-08 05:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2013-12-14 08:56 - 2013-11-08 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2013-12-14 08:56 - 2013-11-08 04:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2013-12-14 08:56 - 2013-11-08 04:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2013-12-14 08:56 - 2013-11-05 15:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2013-12-14 08:56 - 2013-11-05 15:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2013-12-14 08:56 - 2013-11-05 14:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2013-12-14 08:56 - 2013-11-05 14:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2013-12-14 08:56 - 2013-11-05 14:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2013-12-14 08:56 - 2013-11-04 18:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-12-14 08:56 - 2013-11-04 18:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-12-14 08:56 - 2013-11-04 14:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2013-12-14 08:56 - 2013-11-04 12:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-12-14 08:56 - 2013-11-04 11:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2013-12-14 08:56 - 2013-11-04 03:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2013-12-14 08:56 - 2013-11-04 02:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-12-14 08:56 - 2013-11-01 12:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2013-12-14 08:56 - 2013-11-01 07:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll
2013-12-14 08:56 - 2013-11-01 06:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll
2013-12-14 08:56 - 2013-10-31 01:58 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2013-12-14 08:56 - 2013-10-31 01:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2013-12-14 08:56 - 2013-10-31 01:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2013-12-14 08:56 - 2013-10-31 01:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2013-12-14 08:56 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2013-12-14 08:56 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2013-12-14 08:56 - 2013-10-26 02:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys
2013-12-14 08:56 - 2013-10-24 10:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2013-12-14 08:56 - 2013-10-24 10:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2013-12-14 08:56 - 2013-10-17 12:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2013-12-14 08:56 - 2013-10-17 11:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2013-12-14 08:56 - 2013-10-05 15:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-12-14 08:56 - 2013-10-05 15:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-12-14 08:56 - 2013-10-05 13:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-12-14 08:56 - 2013-10-05 13:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll

==================== One Month Modified Files and Folders =======

2014-01-13 21:10 - 2014-01-13 21:10 - 00019162 _____ C:\Users\Axel\Desktop\FRST.txt
2014-01-13 21:10 - 2014-01-13 21:10 - 00000470 _____ C:\Users\Axel\Desktop\defogger_disable.log
2014-01-13 21:10 - 2014-01-13 21:10 - 00000000 ____D C:\FRST
2014-01-13 21:10 - 2014-01-13 21:10 - 00000000 _____ C:\Users\Axel\defogger_reenable
2014-01-13 21:10 - 2013-10-20 10:15 - 00000000 ____D C:\Users\Axel
2014-01-13 21:10 - 2013-09-30 05:14 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-13 21:10 - 2013-09-30 04:58 - 00764340 _____ C:\WINDOWS\system32\perfh007.dat
2014-01-13 21:10 - 2013-09-30 04:58 - 00159160 _____ C:\WINDOWS\system32\perfc007.dat
2014-01-13 21:09 - 2014-01-13 21:09 - 00050477 _____ C:\Users\Axel\Desktop\Defogger.exe
2014-01-13 21:09 - 2013-08-22 15:46 - 00333923 _____ C:\WINDOWS\setupact.log
2014-01-13 21:07 - 2014-01-13 21:09 - 02075648 _____ (Farbar) C:\Users\Axel\Desktop\FRST64.exe
2014-01-13 21:07 - 2014-01-13 21:09 - 00377856 _____ C:\Users\Axel\Desktop\21nwygg6.exe
2014-01-13 21:07 - 2012-11-06 19:24 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2341186111-1703708851-2796005962-1001
2014-01-13 21:06 - 2012-11-06 19:30 - 00001122 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-13 21:02 - 2014-01-13 20:47 - 00000000 ____D C:\WINDOWS\CD09642E061D4844BA37ED1480916404.TMP
2014-01-13 21:02 - 2013-01-02 22:35 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2014-01-13 21:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-13 20:56 - 2013-08-25 18:42 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Spotify
2014-01-13 20:52 - 2013-07-13 12:57 - 00000000 ____D C:\Users\Axel\AppData\Local\Battle.net
2014-01-13 20:48 - 2014-01-13 20:48 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-13 20:48 - 2014-01-13 20:48 - 00000000 _____ C:\autoexec.bat
2014-01-13 20:43 - 2013-03-10 19:13 - 00001132 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001UA.job
2014-01-13 20:40 - 2012-11-07 17:40 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-01-13 20:39 - 2014-01-13 20:39 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2014-01-13 20:39 - 2014-01-13 20:39 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2014-01-13 20:34 - 2014-01-13 20:34 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Axel\Downloads\SpyHunter-Installer.exe
2014-01-13 20:30 - 2014-01-13 20:30 - 00000000 ____D C:\Users\Axel\Documents\Optimizer Pro
2014-01-13 20:20 - 2013-10-20 10:19 - 01749895 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-13 20:03 - 2012-12-04 18:15 - 00000000 ____D C:\ProgramData\MFAData
2014-01-13 20:00 - 2013-10-20 10:26 - 00000000 __RDO C:\Users\Axel\SkyDrive
2014-01-13 20:00 - 2013-08-25 18:42 - 00000000 ____D C:\Users\Axel\AppData\Local\Spotify
2014-01-13 20:00 - 2012-11-06 19:30 - 00001118 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-12 22:27 - 2014-01-01 21:21 - 00000600 _____ C:\Users\Axel\AppData\Local\PUTTY.RND
2014-01-12 22:19 - 2012-11-07 21:27 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Skype
2014-01-12 19:57 - 2014-01-05 20:15 - 00000000 ____D C:\Users\Axel\AppData\Local\LogMeIn Hamachi
2014-01-12 17:29 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-12 17:28 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2014-01-12 16:43 - 2013-03-10 19:13 - 00001080 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001Core.job
2014-01-12 12:21 - 2014-01-12 12:21 - 00000000 ____D C:\Users\Axel\Documents\Elder Scrolls Online
2014-01-12 12:21 - 2014-01-12 12:21 - 00000000 ____D C:\ProgramData\Elder Scrolls Online
2014-01-12 09:14 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2014-01-08 18:26 - 2014-01-08 18:26 - 00000684 _____ C:\Users\Axel\Desktop\The Elder Scrolls Online Beta.lnk
2014-01-08 17:27 - 2014-01-08 17:04 - 55903624 _____ (                                                            ) C:\Users\Axel\Downloads\Install_ESO_Beta.exe
2014-01-07 18:43 - 2014-01-07 18:43 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-01-06 19:05 - 2014-01-06 19:05 - 00000000 ____D C:\Users\Axel\AppData\Local\LogMeIn
2014-01-06 19:05 - 2014-01-06 19:05 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-05 20:14 - 2014-01-05 20:14 - 06373376 _____ C:\Users\Axel\Downloads\hamachi09.msi
2014-01-05 15:27 - 2014-01-05 15:27 - 00000589 _____ C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\putty_0.63.lnk
2014-01-04 19:31 - 2014-01-04 19:31 - 00000000 ____D C:\Users\Axel\Documents\CS50
2014-01-04 15:05 - 2014-01-04 15:05 - 00025764 _____ C:\Users\Axel\Downloads\Jahresbericht 2012.odt
2014-01-04 00:04 - 2014-01-04 00:03 - 00000000 ____D C:\Users\Axel\Downloads\MY WALLPAPER COLLECTION
2014-01-04 00:02 - 2014-01-03 23:43 - 728991017 _____ C:\Users\Axel\Downloads\MY WALLPAPER COLLECTION.zip
2014-01-03 13:03 - 2012-11-13 17:13 - 00002206 _____ C:\WINDOWS\Sandboxie.ini
2014-01-01 21:22 - 2014-01-01 21:22 - 00000600 _____ C:\Users\Axel\AppData\Roaming\winscp.rnd
2014-01-01 21:21 - 2014-01-01 21:21 - 00000995 _____ C:\Users\Public\Desktop\WinSCP.lnk
2014-01-01 21:21 - 2014-01-01 21:21 - 00000000 ____D C:\Program Files (x86)\WinSCP
2014-01-01 21:20 - 2014-01-01 21:20 - 05132128 _____ (Martin Prikryl                                              ) C:\Users\Axel\Downloads\winscp550setup.exe
2013-12-29 14:30 - 2013-12-29 14:30 - 02356494 _____ C:\Users\Axel\Downloads\Enigma4Patch1 (1).rmskin
2013-12-29 14:30 - 2013-12-29 14:29 - 03066102 _____ C:\Users\Axel\Downloads\rainmeter___elegance_2_by_lilshizzy-d41hrge.rmskin
2013-12-29 14:29 - 2013-12-29 14:29 - 02356494 _____ C:\Users\Axel\Downloads\Enigma4Patch1.rmskin
2013-12-29 14:29 - 2013-12-29 14:29 - 00430298 _____ C:\Users\Axel\Downloads\Animus-BlackRoom vr.1.2.rmskin
2013-12-29 14:28 - 2013-12-29 14:28 - 00439467 _____ C:\Users\Axel\Downloads\bar_top_by_serjsilva-d4jcuw9.rmskin
2013-12-22 12:51 - 2013-12-22 12:51 - 00281304 _____ C:\WINDOWS\Minidump\122213-38718-01.dmp
2013-12-22 12:51 - 2013-12-01 18:35 - 00000000 ____D C:\WINDOWS\Minidump
2013-12-22 12:51 - 2013-07-26 16:59 - 516793492 _____ C:\WINDOWS\MEMORY.DMP
2013-12-20 20:53 - 2013-02-04 21:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 20:53 - 2012-11-07 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-12-19 18:38 - 2013-12-19 18:38 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2013-12-19 18:38 - 2013-12-19 18:38 - 00000000 ____D C:\Users\Axel\AppData\Local\FluxSoftware
2013-12-19 17:43 - 2013-12-19 17:43 - 00597304 _____ C:\Users\Axel\Downloads\flux-setup.exe
2013-12-19 17:37 - 2013-12-19 17:37 - 00000000 ____D C:\Users\Axel\AppData\Roaming\7+ Taskbar Tweaker
2013-12-19 17:36 - 2013-12-19 17:36 - 01139416 _____ (RaMMicHaeL) C:\Users\Axel\Downloads\7tt_setup.exe
2013-12-19 17:35 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2013-12-19 17:35 - 2012-11-06 19:30 - 00000000 ____D C:\Users\Axel\AppData\Local\Google
2013-12-19 17:35 - 2012-11-06 19:30 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-19 17:34 - 2013-12-19 17:32 - 17696720 _____ (Google Inc.) C:\Users\Axel\Downloads\picasa39-setup.exe
2013-12-19 02:56 - 2013-12-19 02:56 - 04558848 _____ (Google Inc.) C:\WINDOWS\SysWOW64\GPhotos.scr
2013-12-17 18:28 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2013-12-17 18:03 - 2013-12-17 18:03 - 00281304 _____ C:\WINDOWS\Minidump\121713-39656-01.dmp
2013-12-17 18:03 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2013-12-17 18:03 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore
2013-12-17 18:03 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2013-12-17 18:03 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\FileManager
2013-12-17 18:03 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera
2013-12-17 18:03 - 2013-08-22 15:44 - 00417808 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-15 14:25 - 2013-12-15 14:25 - 17154196 _____ C:\Users\Axel\Downloads\simplesentencethree_by_white_baron-d2ws62q.zip
2013-12-15 12:51 - 2013-12-15 12:51 - 00000000 ____D C:\Users\Axel\Downloads\Pulse_0.6.7.3
2013-12-14 14:34 - 2012-11-24 16:14 - 00000000 ____D C:\Users\Axel\AppData\Local\Skyrim
2013-12-14 10:59 - 2013-07-05 11:02 - 00000000 ____D C:\Users\Axel\AppData\Roaming\Notepad++
2013-12-14 10:51 - 2013-07-23 18:44 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-14 10:50 - 2012-12-13 17:00 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Axel\AppData\Local\Temp\IMsetup.exe
C:\Users\Axel\AppData\Local\Temp\npp.6.5.1.Installer.exe
C:\Users\Axel\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Axel\AppData\Local\Temp\Show-Password_1030-8102.exe
C:\Users\Axel\AppData\Local\Temp\SHSetup.exe
C:\Users\Axel\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Axel\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-12 20:02

==================== End Of Log ============================

Additions

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-01-2014 02
Ran by Axel at 2014-01-13 21:10:53
Running from C:\Users\Axel\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

7 Days to Die (x32 Version:  - The Fun Pimps)
7+ Taskbar Tweaker v4.4.5 (HKCU Version: 4.4.5 - RaMMicHaeL)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
applicationupdater (HKCU Version:  - Sony Online Entertainment)
Arma 2: DayZ Mod (x32 Version:  - )
AVG 2014 (Version: 14.0.3658 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4259 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4259 - AVG Technologies)
Battle.net (x32 Version:  - Blizzard Entertainment)
Battlefield 3™ (x32 Version: 1.5.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.1.7 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (x32 Version:  - )
BattlEye Uninstall (x32 Version:  - )
BOSS (x32 Version: 2.1.1 - BOSS Development Team)
Brütal Legend (x32 Version:  - Double Fine Productions)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.1219.1521.27485 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden
Deadly Boss Mods Updater (x32 Version: 1.07.00 - Master Games International, Inc)
Deadly Boss Mods Updater (x32 Version: 1.07.00 - Master Games International, Inc) Hidden
Definition update for Microsoft Office 2010 (KB982726) (x32 Version:  - Microsoft)
Dota 2 (x32 Version:  - )
Dropbox (HKCU Version: 2.0.22 - Dropbox, Inc.)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
f.lux (HKCU Version:  - )
FileZilla Client 3.6.0.2 (x32 Version: 3.6.0.2 - FileZilla Project)
Forge (x32 Version:  - )
FRITZ!Box-Fernzugang einrichten (x32 Version: 1.0.3 - AVM Berlin)
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Talk Plugin (x32 Version: 4.9.1.16010 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Google+ Auto Backup (x32 Version: 1.0.21.81 - Google)
Hearthstone (x32 Version:  - Blizzard Entertainment)
Hitman: Absolution (x32 Version:  - Square Enix)
Hitman: Sniper Challenge (x32 Version:  - IO Interactive)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Network Connections 18.1.59.0 (Version: 18.1.59.0 - Intel)
Intel(R) Network Connections 18.1.59.0 (Version: 18.1.59.0 - Intel) Hidden
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)
Joe Danger 2: The Movie (x32 Version:  - Hello Games)
KeePass Password Safe 2.23 (x32 Version:  - Dominik Reichl)
League of Legends (x32 Version: 1.3 - Riot Games)
LogMeIn Hamachi (x32 Version: 2.2.0.109 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.109 - LogMeIn, Inc.) Hidden
marvell 91xx driver (x32 Version: 1.2.0.1027 - Marvell)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation) Hidden
MKVToolNix 6.2.0 (x32 Version: 6.2.0 - Moritz Bunkus)
Music Manager (HKCU Version:  - Google, Inc.)
Nexus Mod Manager (Version: 0.46.0 - Black Tree Gaming)
Notepad++ (x32 Version: 6.5.1 - Notepad++ Team)
Opera 12.16 (Version: 12.16.1860 - Opera Software ASA)
Oracle VM VirtualBox 4.3.2 (Version: 4.3.2 - Oracle Corporation)
Origin (x32 Version: 9.1.3.2636 - Electronic Arts, Inc.)
Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)
Papo & Yo (x32 Version:  - Minority Media Inc.)
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
PS3 Media Server (x32 Version: 1.81.0 - PS3 Media Server)
PunkBuster Services (x32 Version: 0.991 - Even Balance, Inc.)
Rainmeter (x32 Version: 3.0.2 r2161 - )
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6865 - Realtek Semiconductor Corp.)
Reus (x32 Version:  - Abbey Games)
Sandboxie 4.06 (64-bit) (Version: 4.06 - Sandboxie Holdings, LLC)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU Version: 0.9.6.81.gd359a796 - Spotify AB)
StarCraft II (x32 Version:  - Blizzard Entertainment)
Surgeon Simulator 2013 (x32 Version:  - Bossa Studios)
The Elder Scrolls Online Beta (x32 Version: 0.3.4 - )
Total War: ROME II (x32 Version:  - Creative Assembly)
Total War: SHOGUN 2 (x32 Version:  - The Creative Assembly)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.6 (Version: 2.0.6 - VideoLAN)
Wallbase Batch Downloader Version 2.7 (x32 Version: 2.7 - codeteq)
WinSCP 5.5 (x32 Version: 5.5 - Martin Prikryl)
World of Warcraft (x32 Version:  - Blizzard Entertainment)
XBMC (HKCU Version:  - Team XBMC)

==================== Restore Points  =========================

21-12-2013 08:41:14 Geplanter Prüfpunkt
30-12-2013 16:48:40 Geplanter Prüfpunkt
05-01-2014 19:14:46 Installed LogMeIn Hamachi
08-01-2014 17:26:38 DirectX wurde installiert
13-01-2014 19:47:51 Installed SpyHunter

==================== Hosts content: ==========================

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {188C9C4D-2756-47E9-A19B-175040EB40CF} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2012-11-02] (Microsoft Corporation)
Task: {1A8E65AB-76FE-455A-ACDD-BC6B2860DE38} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-06] (Google Inc.)
Task: {1BA8FFB3-B2E1-442F-B965-3E136F2FD45C} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2012-11-02] (Microsoft)
Task: {1E789D4E-70E6-4F46-987B-7956B7C749F4} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2012-11-02] (Microsoft Corporation)
Task: {1EB64941-92D0-47FB-B601-2666F4B9503F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001UA => C:\Users\Axel\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-10] (Google Inc.)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8BAFBF7F-67F7-4173-990A-531D5E1B446C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2013-12-14] (Microsoft Corporation)
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {BDC72CEF-F6B3-460A-8168-2D313F00CD8C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-06] (Google Inc.)
Task: {C46DF690-185A-4396-810A-EE249EEFF764} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001Core => C:\Users\Axel\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-10] (Google Inc.)
Task: {C9DCA22A-0F81-4B8C-9B13-0A1DEFD4940B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001Core.job => C:\Users\Axel\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2341186111-1703708851-2796005962-1001UA.job => C:\Users\Axel\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () D:\Prgramme\FileZilla FTP Client\fzshellext_64.dll
2013-10-29 21:45 - 2013-10-29 21:45 - 00798392 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2013-10-29 21:41 - 2013-10-29 21:41 - 00025088 _____ () C:\Program Files\Rainmeter\Plugins\QuotePlugin.dll
2013-10-29 21:41 - 2013-10-29 21:41 - 00058880 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.DLL
2013-10-29 21:44 - 2013-10-29 21:44 - 00368640 _____ () C:\Program Files\Rainmeter\Plugins\NowPlaying.DLL
2012-11-06 22:49 - 2013-07-20 16:47 - 01022464 _____ () C:\Program Files\Opera x64\gstreamer\gstreamer.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00108544 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstaudioconvert.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00106496 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstaudioresample.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00062464 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstautodetect.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00108032 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstcoreplugins.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00073216 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstdecodebin2.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00074752 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstdirectsound.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00201216 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstffmpegcolorspace.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00340480 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstoggdec.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00045056 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstwaveform.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00077312 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstwavparse.dll
2012-11-06 22:49 - 2013-07-20 16:47 - 00115712 _____ () C:\Program Files\Opera x64\gstreamer\plugins\gstwebmdec.dll
2013-12-10 19:40 - 2013-12-10 19:40 - 22332808 _____ () C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Axel\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Bluetooth-Gerät (PAN)
Description: Bluetooth-Gerät (PAN)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: BthPan
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Der angeforderte Dienst wurde bereits gestartet.

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.


==================== Memory info =========================== 

Percentage of memory in use: 40%
Total physical RAM: 8168.59 MB
Available physical RAM: 4863.96 MB
Total Pagefile: 16360.59 MB
Available Pagefile: 13602.48 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:118.9 GB) (Free:45.9 GB) NTFS
Drive d: (Data) (Fixed) (Total:465.76 GB) (Free:379.97 GB) NTFS
Drive e: (WoW) (Fixed) (Total:150 GB) (Free:79.7 GB) NTFS
Drive f: (DATA) (Fixed) (Total:465.76 GB) (Free:381.89 GB) NTFS
Drive g: (Games) (Fixed) (Total:315.76 GB) (Free:120.42 GB) NTFS
Drive i: (USB_Cruzer) (Removable) (Total:3.75 GB) (Free:3.7 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 9EF07B6B)
Partition 1: (Not Active) - (Size=150 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=316 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: FACEB8B7)
Partition 1: (Not Active) - (Size=466 GB) - (Type=42)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: B8DA6459)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 09FA8AE5)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (Size: 4 GB) (Disk ID: 01BFF57E)
Partition 1: (Active) - (Size=4 GB) - (Type=07 NTFS)

==================== End Of Log ============================

GMER

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-13 21:16:56
Windows 6.2.9200  x64 \Device\Harddisk2\DR2 -> \Device\0000002e M4-CT128 rev.0002 119,24GB
Running: 21nwygg6.exe; Driver: C:\Users\Axel\AppData\Local\Temp\kxldapow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                                                                                                           fffff960000ec700 15 bytes [00, EA, 0F, 02, 00, 7F, 6F, ...]
.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                                                                                                      fffff960000ec710 11 bytes [00, 1F, FC, FF, 80, 52, DE, ...]

---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\system32\atiesrxx.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                              00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atiesrxx.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                              00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atiesrxx.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                 00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atiesrxx.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                 00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atieclxx.exe[8796] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                             00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atieclxx.exe[8796] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                             00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atieclxx.exe[8796] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\system32\atieclxx.exe[8796] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\WINDOWS\Explorer.EXE[2664] C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\Comctl32.dll!DPA_InsertPtr  00007ffbe7d83aa0 5 bytes JMP 00007ffce7d70028
.text    C:\WINDOWS\Explorer.EXE[2664] C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\Comctl32.dll!DPA_DeletePtr  00007ffbe7d83b20 5 bytes JMP 00007ffce7d70040
.text    C:\WINDOWS\Explorer.EXE[2664] C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\Comctl32.dll!DPA_Create     00007ffbe7d83d64 5 bytes JMP 00007ffce7d70010
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                               00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                               00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                  00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                  00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                     00007ffbe6011f6a 4 bytes [01, E6, FB, 7F]
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3912] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                     00007ffbe6011f82 4 bytes [01, E6, FB, 7F]
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                               00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                               00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                  00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                  00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                     00007ffbe6011f6a 4 bytes [01, E6, FB, 7F]
.text    C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[436] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                     00007ffbe6011f82 4 bytes [01, E6, FB, 7F]
.text    C:\Program Files\Rainmeter\Rainmeter.exe[1340] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                     00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Rainmeter\Rainmeter.exe[1340] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                     00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Rainmeter\Rainmeter.exe[1340] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                        00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Rainmeter\Rainmeter.exe[1340] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                        00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                         00007ffbeb49169a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                         00007ffbeb4916a2 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                            00007ffbeb49181a 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                            00007ffbeb491832 4 bytes {JMP 0xfffffffffffffffe}
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                                               00007ffbe6011f6a 4 bytes [01, E6, FB, 7F]
.text    C:\Program Files\Opera x64\opera.exe[4364] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                                               00007ffbe6011f82 4 bytes [01, E6, FB, 7F]

---- Threads - GMER 2.1 ----

Thread   C:\WINDOWS\system32\csrss.exe [9008:9196]                                                                                                                                 fffff960008bd4d0
Thread   C:\WINDOWS\system32\csrss.exe [9008:8592]                                                                                                                                 fffff960008bd4d0

---- Services - GMER 2.1 ----

Service  system32\DRIVERS\EsgScanner.sys (*** hidden *** )                                                                                                                         [MANUAL] EsgScanner                                                                                                                       <-- ROOTKIT !!!
Service   (*** hidden *** )                                                                                                                                                        [AUTO] SpyHunter 4 Service                                                                                                                <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{4D5D4026-F4BE-4BE1-909B-2C8957288C12}\Connection@Name                               isatap.{CD2C2C33-0C09-441E-B353-85F9B3CA3AC7}
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                                                         -1785082663
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@Type                                                                                                                    2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@Start                                                                                                                   3
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@ErrorControl                                                                                                            1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@Tag                                                                                                                     3
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@ImagePath                                                                                                               system32\DRIVERS\EsgScanner.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@DisplayName                                                                                                             EsgScanner
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@Group                                                                                                                   FSFilter Activity Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@DependOnService                                                                                                         FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner@Description                                                                                                             Enigma Scan filter
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner\Instances                                                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner\Instances@DefaultInstance                                                                                               EsgScanner
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner\Instances\EsgScanner                                                                                                    
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner\Instances\EsgScanner@Altitude                                                                                           10000
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner\Instances\EsgScanner@Flags                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\EsgScanner                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{4D5D4026-F4BE-4BE1-909B-2C8957288C12}@InterfaceName                                                    isatap.{CD2C2C33-0C09-441E-B353-85F9B3CA3AC7}
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{4D5D4026-F4BE-4BE1-909B-2C8957288C12}@ReusableType                                                     0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{4D5D4026-F4BE-4BE1-909B-2C8957288C12}@DefunctTimestamp                                                 0x32 0xCF 0xCE 0x52 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                                           2956
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                                          315
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service                                                                                                                
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@Type                                                                                                           16
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@Start                                                                                                          2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@ErrorControl                                                                                                   1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@ImagePath                                                                                                      C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@DisplayName                                                                                                    SpyHunter 4 Service
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@Group                                                                                                          Base
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@ObjectName                                                                                                     LocalSystem
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service@Description                                                                                                    SpyHunter 4 Helper Service
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service                                                                                                                
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                                                        0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                                                    0x64 0x62 0x03 0x00 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager@ConfirmationCheckBoxDoForAll                                                               1
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}@Flags                                                                  64
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore@Count                                                            2
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore@Count                                                            16
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore@Blocked                                                          16
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore@Count                                                            2
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive@ScanState                                                                                                         0
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive@MoSkyFileSync                                                                                                     WLS_SubscriptionId_ea793e87-60ba-4588-9449-ff90390273b9
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive@MoSkyQuotaStateChange                                                                                             WLS_SubscriptionId_95fc42af-6f69-4c41-a652-f86065fb252d
Reg      HKCU\Software\Microsoft\Windows\Shell\Bags\1\Desktop@FFlags                                                                                                               1075843620
Reg      HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation                                                                                               C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_update_checker.e_70e995cfc52b1d87e9cb455a7c64d1e0bce52ad7_1b023bb4_13f8429d

---- EOF - GMER 2.1 ----

Windows 8.1 64bit - PC Optimizer Pro und SpyHunter4

Plagegeister aller Art und deren Bekämpfung: Windows 8.1 64bit - PC Optimizer Pro und SpyHunter4

Windows 8.1 64bit - PC Optimizer Pro und SpyHunter4

Ähnliche Themen: Windows 8.1 64bit - PC Optimizer Pro und SpyHunter4