BKA-Befall (inzwischen wieder nutzbar) und malware (lightning Speed Dial startseite)

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-01-2014 02
Ran by Sascha (administrator) on SASCHA on 26-01-2014 20:32:46
Running from C:\Users\Sascha\Downloads
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDWebCam.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPOP3.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPictureViewer.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMovieViewer.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDYT.exe
(Electronic Arts) C:\Battlefield 4\Origin.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
() C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [8292120 2013-11-14] (Logitech Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-29] (Advanced Micro Devices, Inc.)
HKCU\...\Run: [EADM] - C:\Battlefield 4\Origin.exe [3551576 2013-12-05] (Electronic Arts)
HKCU\...\Run: [DriverFinder] - C:\Program Files (x86)\DriverFinder\DriverFinder.exe
MountPoints2: {2b230e2d-4ed4-11e3-824b-806e6f6e6963} - "D:\setup.exe" 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF91CB62584F9CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.awesomehp.com/?type=sc&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\1x09xfbd.default
FF Homepage: https://www.google.at/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\awesomehp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Extension_Protected - C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\1x09xfbd.default\Extensions\jid0-O6MIff3eO5dIGf5Tcv8RsJDKxrs@jetpack.xpi [2014-01-24]
FF Extension: Lightning Speed Dial - C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\1x09xfbd.default\Extensions\lightningnewtab@gmail.com.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [lightningnewtab@gmail.com] - C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\1x09xfbd.default\extensions\lightningnewtab@gmail.com.xpi
FF Extension: No Name - C:\Users\Sascha\AppData\Roaming\Mozilla\Firefox\Profiles\1x09xfbd.default\extensions\lightningnewtab@gmail.com.xpi [2014-01-24]
FF HKCU\...\Firefox\Extensions: [{ccfe239f-e366-4d46-b4fe-4a89f16d64f9}] - C:\Program Files (x86)\Re-markit\150.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.awesomehp.com/?type=sc&ts=1390582312&from=tugs&uid=WDCXWD20EZRX-00D8PB0_WD-WMC4M095606756067

Chrome: 
=======
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-13]
CHR Extension: (Google Drive) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-13]
CHR Extension: (YouTube) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-13]
CHR Extension: (Google-Suche) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-13]
CHR Extension: (avast! Online Security) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-13]
CHR Extension: (Google Wallet) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-13]
CHR Extension: (Google Mail) - C:\Users\Sascha\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-13]

==================== Services (Whitelisted) =================

U2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
U2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
U3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
U3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4519472 2013-11-06] (INCA Internet Co., Ltd.)
U2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-05] ()
U3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
U2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U1 A2DDA; C:\EEK\RUN\a2ddax64.sys [26176 2014-01-13] (Emsisoft GmbH)
U0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
U0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
U3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
U3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
U3 cleanhlp; C:\EEK\Run\cleanhlp64.sys [57024 2014-01-13] (Emsisoft GmbH)
U3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
U3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
U0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
U0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
U3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-03-14] ()
U3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
U0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
U3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
U3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
U3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
U3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
U0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
U3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
U3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U3 DIRECTIO; \??\C:\Program Files\PerformanceTest\DirectIo64.sys [x]
U3 UCORESYS; \??\C:\Windows\Setup\bit\UCORESYS.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-26 20:32 - 2014-01-26 20:32 - 02078208 _____ (Farbar) C:\Users\Sascha\Downloads\FRST64.exe
2014-01-26 20:32 - 2014-01-26 20:32 - 00013179 _____ C:\Users\Sascha\Downloads\FRST.txt
2014-01-26 20:32 - 2014-01-26 20:32 - 00000000 ____D C:\FRST
2014-01-26 20:14 - 2014-01-26 20:14 - 02347384 _____ (ESET) C:\Users\Sascha\Downloads\esetsmartinstaller_enu.exe
2014-01-26 20:14 - 2014-01-26 20:14 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-26 20:10 - 2014-01-26 20:10 - 00001752 _____ C:\sc-cleaner.txt
2014-01-26 20:09 - 2014-01-26 20:09 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Sascha\Downloads\sc-cleaner.exe
2014-01-26 20:09 - 2014-01-26 20:09 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Sascha\Downloads\sc-cleaner(1).exe
2014-01-26 20:08 - 2014-01-26 20:08 - 00000883 _____ C:\Users\Sascha\Desktop\JRT.txt
2014-01-26 20:05 - 2014-01-26 20:05 - 01037068 _____ (Thisisu) C:\Users\Sascha\Downloads\JRT.exe
2014-01-26 20:05 - 2014-01-26 20:05 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 19:53 - 2014-01-26 19:53 - 01236282 _____ C:\Users\Sascha\Downloads\adwcleaner.exe
2014-01-26 19:50 - 2014-01-26 19:50 - 00001132 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Malwarebytes
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 19:50 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-26 19:48 - 2014-01-26 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Sascha\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-24 17:57 - 2014-01-24 18:02 - 00000000 ____D C:\Program Files\My Vapor Record
2014-01-24 17:57 - 2014-01-24 17:57 - 00000857 _____ C:\Users\Sascha\Desktop\MVR.Lnk
2014-01-24 17:57 - 2014-01-24 17:57 - 00000000 ____D C:\Windows\SysWOW64\YingInstall
2014-01-24 17:57 - 2014-01-24 17:57 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\WinRAR
2014-01-24 17:57 - 2013-04-24 18:00 - 04990847 _____ (Joyetech) C:\Users\Sascha\Desktop\MVR1.3_install_0424B.exe
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\AppData\Local\cache
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\.android
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 _____ C:\Users\Sascha\daemonprocess.txt
2014-01-24 17:53 - 2014-01-24 17:56 - 00000000 ____D C:\Program Files (x86)\WinRAR
2014-01-24 17:52 - 2014-01-26 19:36 - 00000000 ____D C:\ProgramData\IePluginService
2014-01-24 17:49 - 2014-01-24 17:49 - 04989451 _____ C:\Users\Sascha\Downloads\MVR1.3_install.rar
2014-01-15 15:15 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-01-15 15:15 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 15:15 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-01-15 15:15 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 15:15 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-01-15 15:15 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-15 15:15 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-15 15:14 - 2013-12-09 01:15 - 00787968 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-01-15 15:14 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\WSCollect.exe
2014-01-15 15:14 - 2013-11-27 11:34 - 00138240 _____ C:\Windows\system32\OEMLicense.dll
2014-01-15 15:14 - 2013-11-27 10:54 - 00103936 _____ C:\Windows\SysWOW64\OEMLicense.dll
2014-01-14 16:52 - 2014-01-24 09:13 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\.minecraft
2014-01-14 16:51 - 2014-01-14 16:51 - 00675988 _____ C:\Users\Sascha\Downloads\Minecraft(1).exe
2014-01-14 16:45 - 2014-01-14 18:56 - 562409472 _____ C:\Users\Sascha\Desktop\Win81DUAL_PRWX_MUI_x64.iso
2014-01-14 15:29 - 2014-01-14 15:29 - 05487040 _____ (Microsoft Corporation) C:\Users\Sascha\Downloads\Windows8-Setup.exe
2014-01-14 15:22 - 2014-01-14 15:22 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\ImgBurn
2014-01-14 15:14 - 2014-01-14 15:15 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\FileZilla
2014-01-14 15:14 - 2014-01-14 15:14 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-01-14 15:14 - 2014-01-14 15:14 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2014-01-14 14:48 - 2014-01-26 20:14 - 00003116 _____ C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-01-14 14:48 - 2014-01-14 14:48 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Nico Mak Computing
2014-01-14 14:47 - 2014-01-14 14:47 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Sascha\Downloads\wzmp_8.exe
2014-01-14 14:47 - 2014-01-14 14:47 - 00001212 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-01-14 14:47 - 2014-01-14 14:47 - 00000000 ____D C:\ProgramData\Nico Mak Computing
2014-01-14 14:47 - 2014-01-14 14:47 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector
2014-01-14 14:47 - 2013-03-15 17:10 - 00020480 _____ C:\Windows\system32\wsusnative64.exe
2014-01-14 14:46 - 2014-01-14 14:46 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Mozilla
2014-01-14 14:41 - 2014-01-14 14:41 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1637095852-1356019290-2617361846-1004
2014-01-14 14:40 - 2014-01-14 14:40 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F499A44-0E5E-4E89-8BD3-A35FE5222714}
2014-01-14 14:38 - 2014-01-14 14:38 - 00000000 __RDO C:\Users\Elodara\SkyDrive
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\Macromedia
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\ATI
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Local\Logitech
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Local\ATI
2014-01-14 14:35 - 2014-01-14 14:38 - 00000000 ____D C:\Users\Elodara\AppData\Local\Packages
2014-01-14 14:35 - 2014-01-14 14:35 - 00001461 _____ C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\Adobe
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ____D C:\Users\Elodara\AppData\Local\VirtualStore
2014-01-14 14:32 - 2014-01-14 14:38 - 00000000 ____D C:\Users\Elodara
2014-01-14 14:32 - 2014-01-14 14:32 - 00000020 ___SH C:\Users\Elodara\ntuser.ini
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Vorlagen
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Startmenü
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Netzwerkumgebung
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Lokale Einstellungen
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Eigene Dateien
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Druckumgebung
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Documents\Eigene Musik
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Documents\Eigene Bilder
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Local\Verlauf
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Local\Anwendungsdaten
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Anwendungsdaten
2014-01-14 14:32 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-01-14 14:32 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-01-14 14:32 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-01-14 14:32 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-01-14 14:13 - 2014-01-14 14:13 - 04954736 _____ (Microsoft Corporation) C:\Users\Sascha\Downloads\WindowsSetupBox.exe
2014-01-13 20:18 - 2014-01-13 20:18 - 00000561 _____ C:\Users\Sascha\Desktop\Emsisoft Emergency Kit.lnk
2014-01-13 20:18 - 2014-01-13 20:18 - 00000000 ____D C:\EEK
2014-01-13 20:07 - 2014-01-13 20:13 - 230740728 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit(2).exe
2014-01-13 20:06 - 2014-01-13 20:06 - 00001888 _____ C:\Users\Public\Desktop\ImgBurn.lnk
2014-01-13 20:06 - 2014-01-13 20:06 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2014-01-13 20:05 - 2014-01-13 20:06 - 26223682 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit.exe.part
2014-01-13 20:05 - 2014-01-13 20:05 - 00000000 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit.exe
2014-01-13 20:04 - 2014-01-26 19:59 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\rmi
2014-01-13 19:55 - 2014-01-24 17:51 - 00001378 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-13 19:55 - 2014-01-13 19:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-13 19:55 - 2014-01-13 19:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-13 19:41 - 2014-01-13 19:41 - 01236282 _____ C:\Users\Sascha\Downloads\adwcleaner_3.017.exe
2014-01-13 19:16 - 2014-01-26 20:12 - 00000000 ____D C:\AdwCleaner
2014-01-13 18:56 - 2014-01-13 18:56 - 00000000 _____ C:\autoexec.bat
2014-01-13 18:54 - 2014-01-13 19:36 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-13 18:54 - 2014-01-13 18:54 - 00000000 ____D C:\sh4ldr
2014-01-13 18:54 - 2014-01-13 18:54 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-13 18:34 - 2014-01-13 18:34 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\AVAST Software
2014-01-13 18:32 - 2014-01-13 18:34 - 00000000 ____D C:\Users\Sascha\AppData\Local\Google
2014-01-13 18:32 - 2014-01-13 18:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-13 18:31 - 2014-01-13 18:31 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-13 18:31 - 2014-01-13 18:31 - 00000000 ____D C:\Program Files\AVAST Software
2014-01-13 15:05 - 2014-01-13 15:05 - 00000000 ____D C:\Users\Sascha\Documents\Hitman Blood Money
2014-01-13 14:42 - 2014-01-13 14:42 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2014-01-13 14:42 - 2014-01-13 14:42 - 00000000 ____D C:\Program Files (x86)\Eidos
2014-01-11 18:05 - 2014-01-11 18:06 - 00272220 _____ C:\Users\Sascha\Downloads\sct-v6.65.zip
2014-01-11 18:02 - 2014-01-11 18:02 - 00109479 _____ C:\Users\Sascha\Downloads\ReforgeLite-v1.37.zip
2014-01-11 18:00 - 2014-01-11 18:00 - 00701606 _____ C:\Users\Sascha\Downloads\Gatherer-4.4.0.zip
2014-01-11 18:00 - 2014-01-11 18:00 - 00397858 _____ C:\Users\Sascha\Downloads\Quartz-3.1.4.zip
2014-01-11 17:59 - 2014-01-11 17:59 - 00686531 _____ C:\Users\Sascha\Downloads\XPerl-r860.zip
2014-01-11 17:57 - 2014-01-11 17:58 - 00421979 _____ C:\Users\Sascha\Downloads\TidyPlates_6_12_6.zip
2014-01-11 17:57 - 2014-01-11 17:57 - 00700728 _____ C:\Users\Sascha\Downloads\TitanPanel-5.2.3.50400.zip
2014-01-11 17:56 - 2014-01-11 17:56 - 00978041 _____ C:\Users\Sascha\Downloads\AckisRecipeList-2.5.13.zip
2014-01-11 17:55 - 2014-01-11 17:55 - 00831606 _____ C:\Users\Sascha\Downloads\TradeSkillMaster-v2.4.4.zip
2014-01-11 17:54 - 2014-01-11 17:54 - 00142671 _____ C:\Users\Sascha\Downloads\Bagnon_5.4.3.zip
2014-01-11 17:53 - 2014-01-11 17:53 - 03835940 _____ C:\Users\Sascha\Downloads\AuctioneerSuite-5.19.5445.zip
2014-01-11 17:53 - 2014-01-11 17:53 - 00299562 _____ C:\Users\Sascha\Downloads\Bartender4-4.5.13.2.zip
2014-01-11 17:51 - 2014-01-11 17:51 - 00380984 _____ C:\Users\Sascha\Downloads\Recount-v5.4.0a_release.zip
2014-01-11 17:50 - 2014-01-11 17:50 - 01754123 _____ C:\Users\Sascha\Downloads\DBM-Core-5.4.6.zip
2014-01-01 18:11 - 2014-01-01 18:11 - 00021504 ___SH C:\Users\Sascha\Desktop\Thumbs.db
2013-12-30 16:07 - 2013-12-30 16:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

==================== One Month Modified Files and Folders =======

2014-01-26 20:32 - 2014-01-26 20:32 - 02078208 _____ (Farbar) C:\Users\Sascha\Downloads\FRST64.exe
2014-01-26 20:32 - 2014-01-26 20:32 - 00013179 _____ C:\Users\Sascha\Downloads\FRST.txt
2014-01-26 20:32 - 2014-01-26 20:32 - 00000000 ____D C:\FRST
2014-01-26 20:26 - 2013-12-05 21:05 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{B400AC20-20D1-433B-B2D7-0605C7BA20B1}
2014-01-26 20:26 - 2013-11-16 09:33 - 01720700 _____ C:\Windows\WindowsUpdate.log
2014-01-26 20:19 - 2013-11-16 09:37 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-26 20:19 - 2013-08-23 00:24 - 00764340 _____ C:\Windows\system32\perfh007.dat
2014-01-26 20:19 - 2013-08-23 00:24 - 00159160 _____ C:\Windows\system32\perfc007.dat
2014-01-26 20:18 - 2013-12-05 21:06 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1637095852-1356019290-2617361846-1001
2014-01-26 20:14 - 2014-01-26 20:14 - 02347384 _____ (ESET) C:\Users\Sascha\Downloads\esetsmartinstaller_enu.exe
2014-01-26 20:14 - 2014-01-26 20:14 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-26 20:14 - 2014-01-14 14:48 - 00003116 _____ C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-01-26 20:13 - 2013-12-05 21:31 - 00000000 ____D C:\Battlefield 4
2014-01-26 20:13 - 2013-12-05 21:01 - 00000000 __RDO C:\Users\Sascha\SkyDrive
2014-01-26 20:12 - 2014-01-13 19:16 - 00000000 ____D C:\AdwCleaner
2014-01-26 20:12 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 20:12 - 2013-08-22 14:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2014-01-26 20:10 - 2014-01-26 20:10 - 00001752 _____ C:\sc-cleaner.txt
2014-01-26 20:09 - 2014-01-26 20:09 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Sascha\Downloads\sc-cleaner.exe
2014-01-26 20:09 - 2014-01-26 20:09 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Sascha\Downloads\sc-cleaner(1).exe
2014-01-26 20:08 - 2014-01-26 20:08 - 00000883 _____ C:\Users\Sascha\Desktop\JRT.txt
2014-01-26 20:05 - 2014-01-26 20:05 - 01037068 _____ (Thisisu) C:\Users\Sascha\Downloads\JRT.exe
2014-01-26 20:05 - 2014-01-26 20:05 - 00000000 ____D C:\Windows\ERUNT
2014-01-26 20:05 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2014-01-26 20:03 - 2013-12-06 23:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-26 20:02 - 2013-11-16 16:31 - 00047410 _____ C:\Windows\PFRO.log
2014-01-26 20:01 - 2013-12-05 21:00 - 00000000 ___RD C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-26 20:00 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\sru
2014-01-26 19:59 - 2014-01-13 20:04 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\rmi
2014-01-26 19:53 - 2014-01-26 19:53 - 01236282 _____ C:\Users\Sascha\Downloads\adwcleaner.exe
2014-01-26 19:50 - 2014-01-26 19:50 - 00001132 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Malwarebytes
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-26 19:50 - 2014-01-26 19:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-26 19:48 - 2014-01-26 19:48 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Sascha\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-26 19:36 - 2014-01-24 17:52 - 00000000 ____D C:\ProgramData\IePluginService
2014-01-24 18:02 - 2014-01-24 17:57 - 00000000 ____D C:\Program Files\My Vapor Record
2014-01-24 17:57 - 2014-01-24 17:57 - 00000857 _____ C:\Users\Sascha\Desktop\MVR.Lnk
2014-01-24 17:57 - 2014-01-24 17:57 - 00000000 ____D C:\Windows\SysWOW64\YingInstall
2014-01-24 17:57 - 2014-01-24 17:57 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\WinRAR
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\AppData\Local\cache
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 ____D C:\Users\Sascha\.android
2014-01-24 17:56 - 2014-01-24 17:56 - 00000000 _____ C:\Users\Sascha\daemonprocess.txt
2014-01-24 17:56 - 2014-01-24 17:53 - 00000000 ____D C:\Program Files (x86)\WinRAR
2014-01-24 17:56 - 2013-12-05 20:59 - 00000000 ____D C:\Users\Sascha
2014-01-24 17:51 - 2014-01-13 19:55 - 00001378 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-24 17:51 - 2013-12-05 21:00 - 00001681 _____ C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-24 17:49 - 2014-01-24 17:49 - 04989451 _____ C:\Users\Sascha\Downloads\MVR1.3_install.rar
2014-01-24 17:48 - 2013-08-22 15:46 - 00011671 _____ C:\Windows\setupact.log
2014-01-24 09:13 - 2014-01-14 16:52 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\.minecraft
2014-01-19 08:38 - 2013-12-07 12:30 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-16 19:49 - 2013-12-09 20:56 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 19:47 - 2013-12-09 20:56 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 22:19 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\WinStore
2014-01-15 15:00 - 2013-12-05 22:34 - 00000000 ____D C:\ShotOnline
2014-01-14 18:56 - 2014-01-14 16:45 - 562409472 _____ C:\Users\Sascha\Desktop\Win81DUAL_PRWX_MUI_x64.iso
2014-01-14 16:51 - 2014-01-14 16:51 - 00675988 _____ C:\Users\Sascha\Downloads\Minecraft(1).exe
2014-01-14 16:11 - 2013-12-05 21:00 - 00000000 ____D C:\Users\Sascha\AppData\Local\Packages
2014-01-14 15:29 - 2014-01-14 15:29 - 05487040 _____ (Microsoft Corporation) C:\Users\Sascha\Downloads\Windows8-Setup.exe
2014-01-14 15:22 - 2014-01-14 15:22 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\ImgBurn
2014-01-14 15:15 - 2014-01-14 15:14 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\FileZilla
2014-01-14 15:14 - 2014-01-14 15:14 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-01-14 15:14 - 2014-01-14 15:14 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2014-01-14 14:48 - 2014-01-14 14:48 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Nico Mak Computing
2014-01-14 14:47 - 2014-01-14 14:47 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Sascha\Downloads\wzmp_8.exe
2014-01-14 14:47 - 2014-01-14 14:47 - 00001212 _____ C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-01-14 14:47 - 2014-01-14 14:47 - 00000000 ____D C:\ProgramData\Nico Mak Computing
2014-01-14 14:47 - 2014-01-14 14:47 - 00000000 ____D C:\Program Files (x86)\WinZip Malware Protector
2014-01-14 14:46 - 2014-01-14 14:46 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Mozilla
2014-01-14 14:41 - 2014-01-14 14:41 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1637095852-1356019290-2617361846-1004
2014-01-14 14:40 - 2014-01-14 14:40 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F499A44-0E5E-4E89-8BD3-A35FE5222714}
2014-01-14 14:38 - 2014-01-14 14:38 - 00000000 __RDO C:\Users\Elodara\SkyDrive
2014-01-14 14:38 - 2014-01-14 14:35 - 00000000 ____D C:\Users\Elodara\AppData\Local\Packages
2014-01-14 14:38 - 2014-01-14 14:32 - 00000000 ____D C:\Users\Elodara
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\Macromedia
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\ATI
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Local\Logitech
2014-01-14 14:36 - 2014-01-14 14:36 - 00000000 ____D C:\Users\Elodara\AppData\Local\ATI
2014-01-14 14:36 - 2013-12-05 21:01 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-14 14:35 - 2014-01-14 14:35 - 00001461 _____ C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ___RD C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ____D C:\Users\Elodara\AppData\Roaming\Adobe
2014-01-14 14:35 - 2014-01-14 14:35 - 00000000 ____D C:\Users\Elodara\AppData\Local\VirtualStore
2014-01-14 14:32 - 2014-01-14 14:32 - 00000020 ___SH C:\Users\Elodara\ntuser.ini
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Vorlagen
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Startmenü
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Netzwerkumgebung
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Lokale Einstellungen
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Eigene Dateien
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Druckumgebung
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Documents\Eigene Musik
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Documents\Eigene Bilder
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Local\Verlauf
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\AppData\Local\Anwendungsdaten
2014-01-14 14:32 - 2014-01-14 14:32 - 00000000 _SHDL C:\Users\Elodara\Anwendungsdaten
2014-01-14 14:13 - 2014-01-14 14:13 - 04954736 _____ (Microsoft Corporation) C:\Users\Sascha\Downloads\WindowsSetupBox.exe
2014-01-13 20:18 - 2014-01-13 20:18 - 00000561 _____ C:\Users\Sascha\Desktop\Emsisoft Emergency Kit.lnk
2014-01-13 20:18 - 2014-01-13 20:18 - 00000000 ____D C:\EEK
2014-01-13 20:13 - 2014-01-13 20:07 - 230740728 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit(2).exe
2014-01-13 20:06 - 2014-01-13 20:06 - 00001888 _____ C:\Users\Public\Desktop\ImgBurn.lnk
2014-01-13 20:06 - 2014-01-13 20:06 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2014-01-13 20:06 - 2014-01-13 20:05 - 26223682 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit.exe.part
2014-01-13 20:05 - 2014-01-13 20:05 - 00000000 _____ C:\Users\Sascha\Downloads\EmsisoftEmergencyKit.exe
2014-01-13 19:55 - 2014-01-13 19:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-13 19:55 - 2014-01-13 19:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-13 19:41 - 2014-01-13 19:41 - 01236282 _____ C:\Users\Sascha\Downloads\adwcleaner_3.017.exe
2014-01-13 19:36 - 2014-01-13 18:54 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-13 19:36 - 2013-12-06 23:28 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2014-01-13 19:34 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\registration
2014-01-13 18:56 - 2014-01-13 18:56 - 00000000 _____ C:\autoexec.bat
2014-01-13 18:54 - 2014-01-13 18:54 - 00000000 ____D C:\sh4ldr
2014-01-13 18:54 - 2014-01-13 18:54 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-13 18:34 - 2014-01-13 18:34 - 00000000 ____D C:\Users\Sascha\AppData\Roaming\AVAST Software
2014-01-13 18:34 - 2014-01-13 18:32 - 00000000 ____D C:\Users\Sascha\AppData\Local\Google
2014-01-13 18:33 - 2014-01-13 18:32 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-13 18:31 - 2014-01-13 18:31 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-13 18:31 - 2014-01-13 18:31 - 00000000 ____D C:\Program Files\AVAST Software
2014-01-13 15:05 - 2014-01-13 15:05 - 00000000 ____D C:\Users\Sascha\Documents\Hitman Blood Money
2014-01-13 14:42 - 2014-01-13 14:42 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2014-01-13 14:42 - 2014-01-13 14:42 - 00000000 ____D C:\Program Files (x86)\Eidos
2014-01-11 18:06 - 2014-01-11 18:05 - 00272220 _____ C:\Users\Sascha\Downloads\sct-v6.65.zip
2014-01-11 18:02 - 2014-01-11 18:02 - 00109479 _____ C:\Users\Sascha\Downloads\ReforgeLite-v1.37.zip
2014-01-11 18:00 - 2014-01-11 18:00 - 00701606 _____ C:\Users\Sascha\Downloads\Gatherer-4.4.0.zip
2014-01-11 18:00 - 2014-01-11 18:00 - 00397858 _____ C:\Users\Sascha\Downloads\Quartz-3.1.4.zip
2014-01-11 17:59 - 2014-01-11 17:59 - 00686531 _____ C:\Users\Sascha\Downloads\XPerl-r860.zip
2014-01-11 17:58 - 2014-01-11 17:57 - 00421979 _____ C:\Users\Sascha\Downloads\TidyPlates_6_12_6.zip
2014-01-11 17:57 - 2014-01-11 17:57 - 00700728 _____ C:\Users\Sascha\Downloads\TitanPanel-5.2.3.50400.zip
2014-01-11 17:56 - 2014-01-11 17:56 - 00978041 _____ C:\Users\Sascha\Downloads\AckisRecipeList-2.5.13.zip
2014-01-11 17:55 - 2014-01-11 17:55 - 00831606 _____ C:\Users\Sascha\Downloads\TradeSkillMaster-v2.4.4.zip
2014-01-11 17:54 - 2014-01-11 17:54 - 00142671 _____ C:\Users\Sascha\Downloads\Bagnon_5.4.3.zip
2014-01-11 17:53 - 2014-01-11 17:53 - 03835940 _____ C:\Users\Sascha\Downloads\AuctioneerSuite-5.19.5445.zip
2014-01-11 17:53 - 2014-01-11 17:53 - 00299562 _____ C:\Users\Sascha\Downloads\Bartender4-4.5.13.2.zip
2014-01-11 17:51 - 2014-01-11 17:51 - 00380984 _____ C:\Users\Sascha\Downloads\Recount-v5.4.0a_release.zip
2014-01-11 17:50 - 2014-01-11 17:50 - 01754123 _____ C:\Users\Sascha\Downloads\DBM-Core-5.4.6.zip
2014-01-06 23:31 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-06 23:31 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-01 18:11 - 2014-01-01 18:11 - 00021504 ___SH C:\Users\Sascha\Desktop\Thumbs.db
2013-12-30 16:07 - 2013-12-30 16:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

Some content of TEMP:
====================
C:\Users\Sascha\AppData\Local\Temp\BackupSetup.exe
C:\Users\Sascha\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Sascha\AppData\Local\Temp\install_flashplayer11x32_mssa_aaa_aih.exe
C:\Users\Sascha\AppData\Local\Temp\Quarantine.exe
C:\Users\Sascha\AppData\Local\Temp\raptrpatch.exe
C:\Users\Sascha\AppData\Local\Temp\raptr_stub.exe
C:\Users\Sascha\AppData\Local\Temp\sonarinst.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 20:20

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-01-2014 02
Ran by Sascha at 2014-01-26 20:33:15
Running from C:\Users\Sascha\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 13.20.100.31129 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1129.1143.20969 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Wireless Display v3.0 (Version: 1.0.0.12 - Advanced Micro Devices, Inc.) Hidden
Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1129.1142.20969 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1129.1143.20969 - Advanced Micro Devices, Inc.) Hidden
DMUninstaller (x32 Version:  - )
ESET Online Scanner v3 (x32 Version:  - )
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
FileZilla Client 3.7.3 (HKCU Version: 3.7.3 - Tim Kosse)
ImgBurn (x32 Version: 2.5.8.0 - LIGHTNING UK!)
Java 7 Update 45 (64-bit) (Version: 7.0.450 - Oracle)
Java SE Development Kit 7 Update 45 (64-bit) (Version: 1.7.0.450 - Oracle)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.51 (Version: 8.51.5 - Logitech Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Microsoft Office (x32 Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
My Vapor Record 1.3 (x32 Version:  - )
Origin (x32 Version: 9.3.6.4639 - Electronic Arts, Inc.)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
ShotOnline (x32 Version: 1.0 - OnNet)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
WinRAR 5.00 (32-bit) (x32 Version: 5.00.0 - win.rar GmbH)
WinZip Malware Protector (x32 Version: 2.1.1000.10798 - WinZip International LLC)
World of Warcraft (x32 Version:  - Blizzard Entertainment)

==================== Restore Points  =========================

04-01-2014 11:07:06 Geplanter Prüfpunkt
12-01-2014 09:41:51 Geplanter Prüfpunkt
13-01-2014 13:42:42 Installiert Hitman Blood Money
13-01-2014 18:31:04 Wiederherstellungsvorgang
16-01-2014 18:47:04 Windows Update
19-01-2014 19:35:06 Windows Update

==================== Hosts content: ==========================

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {0C816C07-7D50-4F46-B251-9FC41D7E0573} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-01-16] (Microsoft Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B61F1FF2-A6EB-4875-9109-858D793CB607} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {C13B1D0D-EFCE-4ABA-97B7-800FD21BFF77} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-01-14 14:47 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-01-14 14:47 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2013-12-05 21:35 - 2013-12-05 21:35 - 00064000 _____ () C:\Battlefield 4\tufao.dll
2014-01-13 19:55 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Elodara\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Sascha\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Der angeforderte Dienst wurde bereits gestartet.

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.


==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 8116.82 MB
Available physical RAM: 5931.91 MB
Total Pagefile: 9396.82 MB
Available Pagefile: 6805.35 MB
Total Virtual: 131072 MB
Available Virtual: 131071.77 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:1862.34 GB) (Free:1755.94 GB) NTFS
Drive d: (DVD_ROM) (CDROM) (Total:4.52 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 68B2D1AD)

Partition: GPT Partition Type
==================== End Of Log ============================