Win7 - Malwarebytes findet (Trojan.Downloader) und Avira - JAVA/Lamar.SAP.46

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.08.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
L*** :: L***SPC [Administrator]

08.02.2014 20:05:13
MBAM-log-2014-02-08 (20-25-36).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 271157
Laufzeit: 17 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCR\AppID\{90A52F08-64AC-4DC6-9D7D-4516670275D3} (Trojan.Downloader) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{90A52F08-64AC-4DC6-9D7D-4516670275D3} (Trojan.Downloader) -> Keine Aktion durchgeführt.
HKCR\Interface\{6C51F7E9-8542-4F25-A30F-2060157752E1} (Trojan.Downloader) -> Keine Aktion durchgeführt.
HKCR\AppID\OKitSpace.DLL (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\OKitSpace (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {AA70C1C8-DE9D-44CA-A3E0-BFEBA9DC321B} -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 3
C:\Windows\System32\config\systemprofile\AppData\Roaming\okitSpace (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\okitSpace\IE (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml (PUP.Optional.Lightning.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 18
C:\Users\L***\AppData\Local\Temp\BetterInstaller.exe (PUP.Optional.Somoto.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\bundlesweetimsetup.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\instloffer.exe (PUP.Optional.Vittalia) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\mgsqlite3.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\MyBabylonTB_google_20120807.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\vit_aartemis.exe (PUP.Optional.SkyTech.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\2827278562\chromeupdaterfull.exe.VIRUS (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\fullpackage_temp1388396535\Baofeng.exe (PUP.Optional.NationZoom.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\fullpackage_temp1388396535\UpDate.dll (PUP.Optional.SkyTech.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\fullpackage_temp1388396535\tmp\WPM.exe (PUP.Optional.WpManager.A) -> Keine Aktion durchgeführt.
C:\Users\L***\AppData\Local\Temp\is1598539481\dealply.exe (PUP.Optional.Dealply) -> Keine Aktion durchgeführt.
C:\Users\L***\Downloads\installer_milkshape_3d_1_8_4_Deutsch.exe (PUP.Optional.Vittalia) -> Keine Aktion durchgeführt.
C:\Windows\Installer\c1cd65.msi (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Windows\Installer\c1cd6b.msi (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Windows\Installer\c1cd71.msi (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\okitSpace\IE\config (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.
C:\Windows\System32\config\systemprofile\AppData\Roaming\okitSpace\IE\OkitSpace.dll (PUP.Optional.OKitSpace.A) -> Keine Aktion durchgeführt.

(Ende)
         

2014-02-09 18:11:46	Scan_Objects$0006         starting   1%         
; --- Settings ---
; Action on detect:	Disinfect automatically
; Scan objects:		All objects
; Try disinfect:	No
; Try delete:		No
; Try delete container:	No
; Scan archives:	No
; Scan mail databases:	No
; Scan plain mail:	No
; Exclude by mask:	No
; Include by mask:	No
; Objects to scan:	
; 	"/media"	Enable=Yes	Recursive=Yes
; ------------------
2014-02-09 18:11:46	Scan_Objects$0006         running    1%         
2014-02-09 19:04:47	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	suspicion	HEUR:Exploit.Script.Generic
2014-02-09 19:04:47	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	skipped
2014-02-09 20:43:05	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	suspicion	HEUR:Exploit.Script.Generic
2014-02-09 20:43:05	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	skipped
2014-02-09 23:20:15	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	suspicion	HEUR:Exploit.Script.Generic
2014-02-09 23:20:15	/media/Acer/Users/L***/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/28/2afc99c-475a82f7	skipped
2014-02-10 00:55:18	Scan_Objects$0006         completed             
;  --- Statistics ---
; Time Start:		2014-02-09 18:11:21
; Time Finish:		2014-02-10 00:55:17
; Completion:		100%
; Processed objects:	1048633
; Total detected:	3
; Detected exact:	0
; Suspicions:		3
; Treats detected:	3
; Untreated:		3
; Disinfected:		0
; Quarantined:		0
; Deleted:		0
; Skipped:		0
; Archived:		5191
; Packed:		5896
; Password protected:	0
; Corrupted:		0
; Errors:		0
; Last object:		
;  ------------------
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:23 on 10/02/2014 (Lara)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014
Ran by L*** (administrator) on L***SPC on 10-02-2014 19:27:51
Running from C:\Users\L***\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Dolby Laboratories Inc.) C:\DOLBY PCEE4\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Mouse Driver\V5\StartAutorun.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Mouse Driver\V5\KMConfig.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(UASSOFT.COM) C:\Program Files (x86)\Multimedia Mouse Driver\V5\KMProcess.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe
() C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-09] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340848 2011-04-02] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [408432 2011-03-29] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [202608 2011-03-29] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-02-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Dolby PCEE4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] - C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-02-18] (CyberLink Corp.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2013-03-29] ()
HKLM-x32\...\Run: [KMConfig] - "C:\Program Files (x86)\Multimedia Mouse Driver\V5\StartAutorun.exe" KMConfig.exe
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3104729303-501990301-4131320042-1000\...\Run: [uTorrent] - "C:\Program Files (x86)\uTorrent\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-3104729303-501990301-4131320042-1000\...\Run: [Facebook Update] - C:\Users\L***\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.)
HKU\S-1-5-21-3104729303-501990301-4131320042-1000\...\Run: [AdobeBridge] - [X]
Startup: C:\Users\Schule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\L***\AppData\Roaming\Mozilla\Firefox\Profiles\w30dnoth.default-1389029185471
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.4 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\L***\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\L***\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [OKitSpace@OKitSpace.es] - C:\Users\L***\AppData\Roaming\okitSpace\Firefox

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\L***\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (No Name) - C:\Users\L***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml [2013-12-30]
CHR Extension: (Hide My Ass! Web Proxy) - C:\Users\L***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmgnmcnlncejehjlnhaglpnoolgbflbd [2012-09-25]
CHR Extension: (Google Wallet) - C:\Users\L***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-02]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-05-22] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2010-01-29] (EZB Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-10 19:27 - 2014-02-10 19:29 - 00019329 _____ () C:\Users\L***\Desktop\FRST.txt
2014-02-10 19:27 - 2014-02-10 19:27 - 00000000 ____D () C:\FRST
2014-02-10 19:26 - 2014-02-10 19:26 - 02150400 _____ (Farbar) C:\Users\L***\Desktop\FRST64.exe
2014-02-10 19:23 - 2014-02-10 19:23 - 00000470 _____ () C:\Users\L***\Desktop\defogger_disable.log
2014-02-10 19:23 - 2014-02-10 19:23 - 00000000 _____ () C:\Users\L***\defogger_reenable
2014-02-10 19:20 - 2014-02-10 19:20 - 00050477 _____ () C:\Users\L***\Desktop\Defogger.exe
2014-02-09 16:17 - 2014-02-09 16:17 - 00175363 _____ () C:\Users\L***\.recently-used.xbel
2014-02-09 15:55 - 1994-10-04 17:48 - 00063284 ____N () C:\Users\L***\Downloads\fettefra.ttf
2014-02-09 15:54 - 2014-02-09 15:54 - 00030273 _____ () C:\Users\L***\Downloads\fettefraktur.zip
2014-02-09 11:49 - 2014-02-09 11:49 - 00000000 ____D () C:\ProgramData\Acer
2014-02-09 11:47 - 2014-02-09 11:47 - 14620768 _____ (Acer Incorporated) C:\Users\L***\Downloads\Updaterpackage.exe
2014-02-08 21:06 - 2014-02-08 21:06 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-08 21:06 - 2014-02-08 21:06 - 00000000 ____D () C:\Users\L***\AppData\Roaming\Avira
2014-02-08 21:05 - 2013-12-18 09:32 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-08 21:05 - 2013-12-18 09:32 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-08 21:05 - 2013-12-18 09:32 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-08 20:34 - 2014-02-08 21:05 - 00000000 ____D () C:\ProgramData\Avira
2014-02-08 20:34 - 2014-02-08 21:05 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-08 13:38 - 2014-02-08 13:38 - 01403460 _____ () C:\Users\L***\Desktop\Sicherungskopie_von_cake.cdr
2014-02-08 13:37 - 2014-02-08 13:52 - 01402859 _____ () C:\Users\L***\Desktop\cake.cdr
2014-02-06 17:57 - 2014-02-06 17:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 17:20 - 2014-02-06 17:20 - 00002230 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Stadt-Accessoires.lnk
2014-02-05 16:24 - 2013-12-04 21:37 - 00148019 _____ () C:\Users\L***\Desktop\douglasveiga_Strawberry_Plant_v1.1.package
2014-02-05 16:23 - 2013-12-05 10:46 - 00001042 _____ () C:\Users\L***\Desktop\douglasveiga_Strawberry_Plant_POL_GER_RUS_SWE_Translations.package
2014-02-04 18:02 - 2014-02-04 23:00 - 13716374 _____ () C:\Users\L***\Desktop\Sicherungskopie_von_PeterHam.cdr
2014-02-04 17:44 - 2014-02-04 23:02 - 13716396 _____ () C:\Users\L***\Desktop\PeterHam.cdr
2014-01-28 23:33 - 2014-01-28 23:34 - 00000000 ____D () C:\Users\L***\Desktop\Logo
2014-01-22 18:06 - 2014-01-22 18:07 - 00000000 ____D () C:\Users\L***\AppData\Local\{DE46B5DF-B34D-4FE6-B457-284733E38E72}
2014-01-17 14:08 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-17 14:08 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-17 14:08 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-17 14:08 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-17 14:07 - 2014-01-17 14:08 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-16 14:08 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-16 14:08 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-16 14:08 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-16 14:08 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 21:12 - 2014-01-14 21:13 - 00019100 _____ () C:\Users\L***\Desktop\Chemie.ods
2014-01-12 21:15 - 2014-02-10 18:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-01-11 13:11 - 2014-01-12 15:55 - 00000000 ____D () C:\Users\L***\Downloads\Karrieren
2014-01-11 11:20 - 2014-01-11 11:22 - 00000000 ____D () C:\AdwCleaner

==================== One Month Modified Files and Folders =======

2014-02-10 19:29 - 2014-02-10 19:27 - 00019329 _____ () C:\Users\L***\Desktop\FRST.txt
2014-02-10 19:27 - 2014-02-10 19:27 - 00000000 ____D () C:\FRST
2014-02-10 19:26 - 2014-02-10 19:26 - 02150400 _____ (Farbar) C:\Users\L***\Desktop\FRST64.exe
2014-02-10 19:23 - 2014-02-10 19:23 - 00000470 _____ () C:\Users\L***\Desktop\defogger_disable.log
2014-02-10 19:23 - 2014-02-10 19:23 - 00000000 _____ () C:\Users\L***\defogger_reenable
2014-02-10 19:23 - 2011-10-06 15:37 - 00000000 ___HD () C:\Users\L***
2014-02-10 19:20 - 2014-02-10 19:20 - 00050477 _____ () C:\Users\L***\Desktop\Defogger.exe
2014-02-10 19:19 - 2012-05-20 17:37 - 00000749 _____ () C:\Windows\wininit.ini
2014-02-10 19:05 - 2011-10-06 18:35 - 00000000 ____D () C:\Users\L***\AppData\Roaming\SoftGrid Client
2014-02-10 19:00 - 2011-07-19 03:31 - 02042382 _____ () C:\Windows\WindowsUpdate.log
2014-02-10 18:55 - 2012-09-05 22:50 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-10 18:43 - 2012-09-05 22:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-10 18:05 - 2014-01-12 21:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-10 16:45 - 2011-10-07 12:34 - 00001134 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000UA.job
2014-02-10 16:45 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-10 16:45 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-10 16:40 - 2013-05-24 12:25 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{A2951B02-97E6-44A0-BE05-56643FF82D43}
2014-02-10 16:40 - 2011-10-06 17:26 - 00000000 ____D () C:\ProgramData\clear.fi
2014-02-10 16:38 - 2012-09-05 22:50 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-10 16:38 - 2009-07-14 05:51 - 00268828 _____ () C:\Windows\setupact.log
2014-02-10 16:37 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-09 16:40 - 2009-07-14 05:45 - 05074080 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-09 16:19 - 2011-10-08 10:40 - 00000000 ___HD () C:\Users\L***\.gimp-2.6
2014-02-09 16:17 - 2014-02-09 16:17 - 00175363 _____ () C:\Users\L***\.recently-used.xbel
2014-02-09 16:17 - 2011-10-08 10:48 - 00000000 ____D () C:\Users\L***\AppData\Roaming\gtk-2.0
2014-02-09 15:54 - 2014-02-09 15:54 - 00030273 _____ () C:\Users\L***\Downloads\fettefraktur.zip
2014-02-09 12:36 - 2012-11-16 19:00 - 00105840 _____ () C:\Windows\system32\GDIPFONTCACHEV1.DAT
2014-02-09 11:50 - 2011-06-01 05:46 - 00000000 ____D () C:\Program Files\Acer
2014-02-09 11:49 - 2014-02-09 11:49 - 00000000 ____D () C:\ProgramData\Acer
2014-02-09 11:49 - 2011-06-01 05:14 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-09 11:47 - 2014-02-09 11:47 - 14620768 _____ (Acer Incorporated) C:\Users\L***\Downloads\Updaterpackage.exe
2014-02-09 10:24 - 2010-11-21 04:47 - 00208514 _____ () C:\Windows\PFRO.log
2014-02-08 22:44 - 2011-10-07 12:34 - 00001112 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000Core.job
2014-02-08 21:21 - 2011-10-06 15:40 - 00000000 ___RD () C:\Users\L***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 21:06 - 2014-02-08 21:06 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-08 21:06 - 2014-02-08 21:06 - 00000000 ____D () C:\Users\L***\AppData\Roaming\Avira
2014-02-08 21:05 - 2014-02-08 20:34 - 00000000 ____D () C:\ProgramData\Avira
2014-02-08 21:05 - 2014-02-08 20:34 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-08 20:28 - 2011-10-06 18:21 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-02-08 20:18 - 2012-09-05 22:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-08 20:18 - 2012-04-04 10:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-08 20:18 - 2011-12-06 16:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-08 20:18 - 2011-10-10 18:30 - 00000000 ___HD () C:\Users\L***\AppData\Local\Adobe
2014-02-08 19:15 - 2012-05-22 17:01 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-02-08 13:52 - 2014-02-08 13:37 - 01402859 _____ () C:\Users\L***\Desktop\cake.cdr
2014-02-08 13:38 - 2014-02-08 13:38 - 01403460 _____ () C:\Users\L***\Desktop\Sicherungskopie_von_cake.cdr
2014-02-08 11:39 - 2012-05-25 19:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-06 17:58 - 2014-02-06 17:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 17:20 - 2014-02-06 17:20 - 00002230 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Stadt-Accessoires.lnk
2014-02-05 22:52 - 2012-05-20 17:38 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-02-04 23:02 - 2014-02-04 17:44 - 13716396 _____ () C:\Users\L***\Desktop\PeterHam.cdr
2014-02-04 23:00 - 2014-02-04 18:02 - 13716374 _____ () C:\Users\L***\Desktop\Sicherungskopie_von_PeterHam.cdr
2014-02-04 19:14 - 2011-07-19 13:23 - 00697550 _____ () C:\Windows\system32\perfh007.dat
2014-02-04 19:14 - 2011-07-19 13:23 - 00148556 _____ () C:\Windows\system32\perfc007.dat
2014-02-04 19:14 - 2009-07-14 06:13 - 01614964 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-04 14:02 - 2012-09-05 22:51 - 00002179 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-03 19:23 - 2012-05-20 17:38 - 00000000 ____D () C:\ProgramData\Origin
2014-01-28 23:34 - 2014-01-28 23:33 - 00000000 ____D () C:\Users\L***\Desktop\Logo
2014-01-26 16:09 - 2013-11-22 16:01 - 00008704 _____ () C:\Users\L***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-26 16:09 - 2013-11-22 16:01 - 00000000 ____D () C:\Users\L***\Documents\ezvid
2014-01-26 16:09 - 2012-01-08 14:37 - 00000000 ____D () C:\Users\L***\AppData\Roaming\Audacity
2014-01-26 14:47 - 2013-02-20 23:27 - 00000000 ____D () C:\tmp
2014-01-22 18:07 - 2014-01-22 18:06 - 00000000 ____D () C:\Users\L***\AppData\Local\{DE46B5DF-B34D-4FE6-B457-284733E38E72}
2014-01-19 08:33 - 2010-11-21 04:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-17 15:04 - 2013-10-28 20:16 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-17 14:08 - 2014-01-17 14:07 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-17 14:08 - 2011-12-24 13:24 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-17 08:42 - 2013-07-17 20:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-17 08:34 - 2011-10-23 09:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 18:30 - 2014-01-03 12:29 - 00000016 ___RH () C:\Users\L***\AppData\Local\1B8F34E0.ini
2014-01-14 21:13 - 2014-01-14 21:12 - 00019100 _____ () C:\Users\L***\Desktop\Chemie.ods
2014-01-13 06:42 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 15:55 - 2014-01-11 13:11 - 00000000 ____D () C:\Users\L***\Downloads\Karrieren
2014-01-11 11:22 - 2014-01-11 11:20 - 00000000 ____D () C:\AdwCleaner
2014-01-11 11:22 - 2011-10-06 15:40 - 00000997 _____ () C:\Users\L***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\AutoRun.exe
C:\Users\Administrator\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\L***\AppData\Local\Temp\84962-658111-microsoft-office-2010-professional.exe
C:\Users\L***\AppData\Local\Temp\AutoRun.exe
C:\Users\L***\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\L***\AppData\Local\Temp\avgnt.exe
C:\Users\L***\AppData\Local\Temp\bdfilters.dll
C:\Users\L***\AppData\Local\Temp\BetterInstaller.exe
C:\Users\L***\AppData\Local\Temp\bundlesweetimsetup.exe
C:\Users\L***\AppData\Local\Temp\DriverDetective.exe
C:\Users\L***\AppData\Local\Temp\eauninstall.exe
C:\Users\L***\AppData\Local\Temp\First15.exe
C:\Users\L***\AppData\Local\Temp\guninst.exe
C:\Users\L***\AppData\Local\Temp\installerdll1072756.dll
C:\Users\L***\AppData\Local\Temp\installerdll685327.dll
C:\Users\L***\AppData\Local\Temp\installhelper.dll
C:\Users\L***\AppData\Local\Temp\instloffer.exe
C:\Users\L***\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\L***\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\L***\AppData\Local\Temp\mgsqlite3.dll
C:\Users\L***\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
C:\Users\L***\AppData\Local\Temp\Quarantine.exe
C:\Users\L***\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\L***\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\L***\AppData\Local\Temp\SkypeSetup.exe
C:\Users\L***\AppData\Local\Temp\sonarinst.exe
C:\Users\L***\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\L***\AppData\Local\Temp\The Sims 2_uninst.exe
C:\Users\L***\AppData\Local\Temp\UnityWebPlayer994268225376254442.exe
C:\Users\L***\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\L***\AppData\Local\Temp\VP6Install.exe
C:\Users\L***\AppData\Local\Temp\VP6VFW.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 18:50

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-02-2014
Ran by L***a at 2014-02-10 19:29:48
Running from C:\Users\L***a\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Acer Backup Manager (x32 Version: 3.0.0.99 - NTI Corporation)
Acer Crystal Eye Webcam (x32 Version: 1.0.1710 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1710 - CyberLink Corp.) Hidden
Acer ePower Management (x32 Version: 6.00.3007 - Acer Incorporated)
Acer eRecovery Management (x32 Version: 5.00.3501 - Acer Incorporated)
Acer GameZone Console (x32 Version: 6.1.0.40497 - Oberon Media, Inc.)
Acer Registration (x32 Version: 1.04.3502 - Acer Incorporated)
Acer ScreenSaver (x32 Version: 1.1.1206.2010 - Acer Incorporated)
Acer Updater (x32 Version: 1.02.3502 - Acer Incorporated)
Acrobat.com (x32 Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.1530 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.1530 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.) Hidden
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (x32 Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.0.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe InDesign CS5.5 (x32 Version: 7.5 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (x32 Version: 2.10 - Michael Tippach)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36 - Atheros Communications Inc.)
ATI Catalyst Install Manager (Version: 3.0.812.0 - ATI Technologies, Inc.)
Audacity 1.3.14 (Unicode) (x32 Version:  - Audacity Team)
Avira Free Antivirus (x32 Version: 14.0.2.344 - Avira)
Backup Manager V3 (x32 Version: 3.0.0.99 - NTI Corporation) Hidden
Bamboo (Version:  - Wacom Technology Corp.)
Bamboo (x32 Version:  - )
Bamboo Dock (x32 Version: 4.0 - Wacom Co., Ltd.)
Bamboo Dock (x32 Version: 4.1.0 - Wacom Europe GmbH) Hidden
Bandisoft MPEG-1 Decoder (x32 Version:  - )
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.1.7 - EA Digital Illusions CE AB)
Bejeweled 2 Deluxe (x32 Version:  - Oberon Media)
Blender (Version: 2.65a-release - Blender Foundation)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0208.2202.39516 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0208.2202.39516 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help English (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help French (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help German (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0208.2201.39516 - ATI) Hidden
ccc-core-static (x32 Version: 2011.0208.2202.39516 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2011.0208.2202.39516 - ATI) Hidden
Chicken Invaders 3 (x32 Version:  - Oberon Media)
clear.fi (x32 Version: 1.0.1422.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1422.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.7418 - CyberLink Corp.) Hidden
clear.fi Client (x32 Version: 1.00.3500 - Acer Incorporated)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - BR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Capture (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Common (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Connect (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Custom Data (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - DE (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Draw (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - EN (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - ES (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Extra Content (x32 Version:  - Corel Corporation)
CorelDRAW Graphics Suite X5 - Extra Content (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Filters (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FontNav (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IPM (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - NL (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Photozoom Plugin (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Premium Fonts (x32 Version: 1.00.0000 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Redist (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Setup Files (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VBA (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VideoBrowser (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VSTA (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - WT (x32 Version: 15.3 -  Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW(R) Graphics Suite X5 (x32 Version: 15.2.0.686 - Corel Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DDS Converter 2.1 (x32 Version:  - )
Die Sims™ 3 "Erstelle eine Welt"-Tool - Beta (x32 Version: 1.19.6 - Electronic Arts)
Die Sims™ 3 (x32 Version: 1.67.2 - Electronic Arts)
Die Sims™ 3 Erstelle ein Muster-Tool (x32 Version: 1.0.0 - Electronic Arts)
Die Sims™ 3 Jahreszeiten (x32 Version: 16.0.136 - Electronic Arts)
Die Sims™ 3 Stadt-Accessoires (x32 Version: 9.0.73 - Electronic Arts)
Dolby Advanced Audio v2 (x32 Version: 7.2.7000.4 - Dolby Laboratories Inc)
Dream Day First Home (x32 Version:  - Oberon Media)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
ETDWare PS/2-X64 8.0.6.0_WHQL (Version: 8.0.6.0 - ELAN Microelectronic Corp.)
Ezvid (x32 Version: 0982 - Ezvid, inc.)
Facebook Video Calling 2.0.0.447 (x32 Version: 2.0.447 - Skype Limited)
Farm Frenzy 3 Ice Age (x32 Version:  - Oberon Media)
Flip Words (x32 Version:  - Oberon Media)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galapago (x32 Version:  - Oberon Media)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GIMP 2.6.8 (Version:  - )
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (x32 Version: 1 - Microsoft Corporation)
Identity Card (x32 Version: 1.00.3501 - Acer Incorporated)
IL Download Manager (x32 Version:  - Image-Line)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004 - Intel Corporation)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (x32 Version: 6.0.220 - Oracle)
Java(TM) 7 Update 2 (64-bit) (Version: 7.0.20 - Oracle)
Java(TM) SE Development Kit 7 Update 2 (64-bit) (Version: 1.7.0.20 - Oracle)
JavaFX 2.0.2 (64-bit) (Version: 2.0.2 - Oracle Corporation)
JavaFX 2.0.2 SDK (64-bit) (Version: 2.0.2 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LAME v3.98.3 for Audacity (x32 Version:  - )
Launch Manager (x32 Version: 5.1.4 - Acer Inc.)
Makehuman (x32 Version:  - )
MediaEspresso (x32 Version: 1.0.1418_35759 - CyberLink Corp.) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
MilkShape 3D 1.8.4 (x32 Version: 1.8.4 - chUmbaLum sOft)
Minutor (x32 Version: 1.6.0 - Sean Kasun)
Mozilla Firefox 27.0 (x86 de) (x32 Version: 27.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 27.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (x32 Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Multimedia Mouse Driver (x32 Version: 2.0 - Ihr Firmenname)
Multimedia Mouse Driver (x32 Version: 2.0 - Ihr Firmenname) Hidden
MuseScore 1.3 (x32 Version: 1.3.0 - Werner Schweer and Others)
MyWinLocker (Version: 4.0.14.25 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.25 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.15 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.15 - Egis Technology Inc.) Hidden
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
NTI Media Maker 9 (x32 Version: 9.0.2.8942 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8942 - NTI Corporation) Hidden
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
Origin (x32 Version: 8.6.0.357 - Electronic Arts, Inc.)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
PunkBuster Services (x32 Version: 0.991 - Even Balance, Inc.)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30123 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0 - Renesas Electronics Corporation) Hidden
RGSS-RTP Standard (x32 Version: 1.0.0 - Enterbrain)
RPGXP (x32 Version: 1.0.0 - Enterbrain)
s3oc - Sims3 Object Cloner (x32 Version: 13-1112-2036 - Peter L Jones)
s3pe - Sims3 Package Editor (x32 Version: 13-1112-2033 - Peter L Jones)
s3pe meshHelper for Blender (x32 Version: 12-0601-2217 - Peter L Jones)
s3pe meshHelper for MilkShape (x32 Version: 12-0601-2217 - Peter L Jones)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)
SlimDX Runtime .NET 2.0 (January 2012) (x32 Version: 2.0.13.43 - SlimDX Group)
Sprill and Ritchie (x32 Version:  - Oberon Media)
TSR Workshop (x32 Version: 2.0.80 - The Sims Resource)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0 - Intel)
UltraISO Premium V9.36 (x32 Version:  - )
Unity Web Player (HKCU Version:  - Unity Technologies ApS)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Vegas Pro 11.0 (x32 Version: 11.0.370 - Sony)
Visual Basic for Applications (R) Core - English (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core - German (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core (x32 Version: 6.4.99.69 - Microsoft Corporation) Hidden
VLC media player 1.1.11 (x32 Version: 1.1.11 - VideoLAN)
Vocup 1.4.3 (x32 Version: 1.4.3 - Florian Amstutz)
WebTablet IE Plugin (x32 Version: 1.1.0.5 - Wacom Technology Corp.)
WebTablet Netscape Plugin (x32 Version: 1.1.0.4 - Wacom Technology Corp.)
Welcome Center (x32 Version: 1.02.3501 - Acer Incorporated)
WIDCOMM Bluetooth Software (Version: 6.3.0.8200 - Broadcom Corporation)
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel ParçaL*** (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
World of Goo (x32 Version:  - Oberon Media)
WPM17.8.0.3159 (x32 Version: 17.8.0.3159 - Cherished Technololgy LIMITED) <==== ATTENTION
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

24-01-2014 06:45:43 Windows Update
28-01-2014 11:49:17 Windows Update
31-01-2014 13:47:12 Windows Update
03-02-2014 15:57:17 Windows Update
04-02-2014 13:22:33 Installiert The Sims 3
06-02-2014 16:16:17 Installiert The Sims 3 Town Life Stuff
07-02-2014 13:50:18 Windows Update
08-02-2014 19:23:03 Removed Microsoft Silverlight
09-02-2014 10:49:02 Installiert Acer Updater

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-09-30 13:28 - 00002152 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 3dns.adobe.com 
127.0.0.1 3dns.adobe.de
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-1.adobe.de
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-2.adobe.de
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-3.adobe.de
127.0.0.1 3dns-4.adobe.com
127.0.0.1 3dns-4.adobe.de
127.0.0.1 activate.adobe.com
127.0.0.1 activate.adobe.de
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 activate.wip3.adobe.de 
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sea.adobe.de
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate-sjc0.adobe.de
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns.adobe.de
127.0.0.1 adobe-dns-1.adobe.com
127.0.0.1 adobe-dns-1.adobe.de
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-2.adobe.de
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 adobe-dns-3.adobe.de
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 adobe-dns-4.adobe.de
127.0.0.1 adobe-dns-5.adobe.com

There are 14 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {05AA0967-E517-47A5-BE1E-3705F4C3B9C9} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {13C2DE41-17D5-48E6-AD97-4D1189EDBE9A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-05] (Google Inc.)
Task: {45932AC4-993B-46EC-89DD-45F922006E87} - System32\Tasks\{663196D4-7389-4736-8678-1E89D9047488} => C:\Users\L***a\Downloads\desktop.exe
Task: {55F042FF-C088-4F88-AB49-6A8A6E069149} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000UA => C:\Users\L***a\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: {582659D9-6B73-42D0-969C-954EF07E423E} - System32\Tasks\AdobeAAMUpdater-1.0-L***asPC-L***a => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {5CF7F18C-ACC6-4BF0-B0FB-61BD34548E08} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {7A407203-2B9A-4E96-9AC7-BBEBDAEAAD80} - System32\Tasks\AdobeAAMUpdater-1.0-L***asPC-Schule => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {842E9F21-A362-4985-8D38-1950F8064879} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-08] (Adobe Systems Incorporated)
Task: {8ADF0033-7727-4D2F-9544-633B8A3471A7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-05] (Google Inc.)
Task: {C30912AC-E3C4-496E-9E1F-F1E4E74CC5F0} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-02-22] (CyberLink Corp.)
Task: {C424A156-0B66-4301-9037-0D73DEB019AB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D4AA6DD2-E281-4137-8646-634AD7E00C46} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-02-22] (Acer Incorporated)
Task: {E6B9FE7E-903B-4F09-81E8-367AAD27D584} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-02-22] (CyberLink)
Task: {F750A8ED-0C95-482D-8733-F6AD779C8176} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000Core => C:\Users\L***a\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000Core.job => C:\Users\L***a\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3104729303-501990301-4131320042-1000UA.job => C:\Users\L***a\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-01-22 00:45 - 2009-01-22 00:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2011-03-25 16:19 - 2011-03-25 16:19 - 00205088 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2011-09-27 04:45 - 2013-03-29 10:31 - 00646744 _____ () C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
2010-02-28 01:33 - 2010-02-28 01:33 - 00077664 _____ () C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
2014-02-08 21:05 - 2013-12-18 09:32 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 19:06 - 2012-05-30 19:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-04-24 02:29 - 2011-04-24 02:29 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2011-04-24 02:29 - 2011-04-24 02:29 - 01081664 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2011-04-24 02:29 - 2011-04-24 02:29 - 00125760 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-05-22 17:44 - 2012-05-22 17:49 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2011-02-22 09:01 - 2011-02-22 09:01 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2007-08-05 21:31 - 2007-08-05 21:31 - 00114688 _____ () C:\Program Files (x86)\Multimedia Mouse Driver\V5\keydll.dll
2007-08-05 22:53 - 2007-08-05 22:53 - 00053248 _____ () C:\Program Files (x86)\Multimedia Mouse Driver\V5\MouseHook.dll
2013-08-17 11:10 - 2013-08-17 11:10 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\aaa4ef52ab87ab354f29bfe56152f1c6\IsdiInterop.ni.dll
2011-06-01 05:14 - 2011-01-13 01:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-02-06 17:57 - 2014-02-06 17:58 - 03583600 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:1D6686D8
AlternateDataStreams: C:\ProgramData\Temp:2430E4FC
AlternateDataStreams: C:\ProgramData\Temp:4D066AD2
AlternateDataStreams: C:\ProgramData\Temp:5925E400
AlternateDataStreams: C:\ProgramData\Temp:5D458568
AlternateDataStreams: C:\ProgramData\Temp:8173A019
AlternateDataStreams: C:\ProgramData\Temp:9B750A13

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2014 07:10:32 PM) (Source: Application Hang) (User: )
Description: Programm NOTEPAD.EXE, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 6ac

Startzeit: 01cf268ad1f34743

Endzeit: 0

Anwendungspfad: C:\Windows\system32\NOTEPAD.EXE

Berichts-ID: 923d68ff-927e-11e3-94d1-b870f4ad2bab

Error: (02/10/2014 06:59:17 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 143007

Error: (02/10/2014 06:59:17 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 143007

Error: (02/10/2014 06:59:14 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/10/2014 04:47:38 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (02/10/2014 04:38:15 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/09/2014 04:35:04 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15585

Error: (02/09/2014 04:35:04 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15585

Error: (02/09/2014 04:35:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/09/2014 03:57:54 PM) (Source: Application Hang) (User: )
Description: Programm gimp-2.6.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1f70

Startzeit: 01cf25a71ac480d0

Endzeit: 4

Anwendungspfad: C:\Program Files\GIMP-2.0\bin\gimp-2.6.exe

Berichts-ID: 898af15b-919a-11e3-8fd3-b870f4ad2bab


System errors:
=============
Error: (02/10/2014 06:59:10 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TouchServicePen erreicht.

Error: (02/09/2014 04:35:39 PM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.54
registriert werden. Der Computer mit IP-Adresse 192.168.2.20 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/09/2014 00:04:17 PM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.54
registriert werden. Der Computer mit IP-Adresse 192.168.2.20 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/09/2014 11:59:03 AM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.54
registriert werden. Der Computer mit IP-Adresse 192.168.2.20 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/09/2014 08:35:37 AM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.54
registriert werden. Der Computer mit IP-Adresse 192.168.2.20 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (02/09/2014 08:35:06 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TouchServicePen erreicht.

Error: (02/09/2014 07:40:58 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TouchServicePen erreicht.

Error: (02/09/2014 07:40:28 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TabletServicePen erreicht.

Error: (02/08/2014 08:59:07 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "DM7020",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DEFA07D4-9076-4696-82CD-D2C09B154CE8}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (02/08/2014 08:07:04 PM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.2.54
registriert werden. Der Computer mit IP-Adresse 192.168.2.20 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.


Microsoft Office Sessions:
=========================
Error: (02/10/2014 07:10:32 PM) (Source: Application Hang)(User: )
Description: NOTEPAD.EXE6.1.7600.163856ac01cf268ad1f347430C:\Windows\system32\NOTEPAD.EXE923d68ff-927e-11e3-94d1-b870f4ad2bab

Error: (02/10/2014 06:59:17 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 143007

Error: (02/10/2014 06:59:17 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 143007

Error: (02/10/2014 06:59:14 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/10/2014 04:47:38 PM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (02/10/2014 04:38:15 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/09/2014 04:35:04 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15585

Error: (02/09/2014 04:35:04 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15585

Error: (02/09/2014 04:35:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/09/2014 03:57:54 PM) (Source: Application Hang)(User: )
Description: gimp-2.6.exe0.0.0.01f7001cf25a71ac480d04C:\Program Files\GIMP-2.0\bin\gimp-2.6.exe898af15b-919a-11e3-8fd3-b870f4ad2bab


==================== Memory info =========================== 

Percentage of memory in use: 65%
Total physical RAM: 2029.86 MB
Available physical RAM: 694.93 MB
Total Pagefile: 4059.72 MB
Available Pagefile: 1910.24 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:449.66 GB) (Free:221.57 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 0DD52B58)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-10 20:03:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GN00 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\L***\AppData\Local\Temp\fwldapow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[2152] C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe!?SparseBitMask@DataSourceDescription@FlexUI@@2HB + 960  000000002dcb5984 4 bytes [CE, C4, 1E, 16]
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                     0000000075911465 2 bytes [91, 75]
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                    00000000759114bb 2 bytes [91, 75]
.text    ...                                                                                                                                                                                                                                   * 2
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                0000000077e7f9e0 5 bytes JMP 000000016c146f86
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                                                          0000000077e7f9f8 5 bytes JMP 000000016c14741f
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                                              0000000077e7fa28 5 bytes JMP 000000016c141027
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                                    0000000077e7fa40 5 bytes JMP 000000016c1408b2
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                                             0000000077e7fa90 5 bytes JMP 000000016c14072c
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                                        0000000077e7faa8 5 bytes JMP 000000016c14083a
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                                            0000000077e7fb40 5 bytes JMP 000000016c1413d1
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                   0000000077e7fc38 5 bytes JMP 000000016c1453c5
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                                         0000000077e7fd4c 5 bytes JMP 000000016c1406b4
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                             0000000077e7fd64 5 bytes JMP 000000016c1459b5
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                                   0000000077e7fd98 5 bytes JMP 000000016c144a3a
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                      0000000077e7fe44 5 bytes JMP 000000016c147001
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                                  0000000077e7fe5c 5 bytes JMP 000000016c145b37
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                           0000000077e800b4 5 bytes JMP 000000016c1457ed
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                          0000000077e801c4 5 bytes JMP 000000016c14092a
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                                           0000000077e809e4 5 bytes JMP 000000016c1455e0
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                                            0000000077e809fc 5 bytes JMP 000000016c13d7fa
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                       0000000077e80a44 5 bytes JMP 000000016c13d8c8
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                                             0000000077e80b80 5 bytes JMP 000000016c13d861
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                                      0000000077e80f70 5 bytes JMP 000000016c1409a2
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                                             0000000077e80f88 5 bytes JMP 000000016c140dff
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                                            0000000077e81018 5 bytes JMP 000000016c14112f
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                                              0000000077e8133c 5 bytes JMP 000000016c145bc7
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                                0000000077e8147c 5 bytes JMP 000000016c140d83
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                                  0000000077e81528 5 bytes JMP 000000016c147397
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                                            0000000077e81718 5 bytes JMP 000000016c13dd06
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                                    0000000077e81a58 5 bytes JMP 000000016c1407b4
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                                    0000000077e81b9c 5 bytes JMP 000000016c14712e
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                                      000000007774103d 5 bytes JMP 000000016c119bba
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                      0000000077741072 5 bytes JMP 000000016c119cf8
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!ReplaceFile                                                                                         0000000077760dac 5 bytes JMP 000000016c117e04
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                                000000007776c965 5 bytes JMP 000000016c119f2e
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!ReplaceFileA                                                                                        00000000777beab9 5 bytes JMP 000000016c117d24
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryW                                                                                    00000000777c0083 5 bytes JMP 000000016c11a851
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryA                                                                                    00000000777c012b 5 bytes JMP 000000016c11ab84
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                             00000000777c2c51 5 bytes JMP 000000016c11a3f3
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!AllocConsole                                                                                        00000000777e6afe 5 bytes JMP 000000016c148595
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\kernel32.dll!AttachConsole                                                                                       00000000777e6bc2 5 bytes JMP 000000016c1485a7
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                    0000000076272aa4 5 bytes JMP 000000016c11ad8f
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesW                                                                              0000000075c11e3a 7 bytes JMP 000000016c12b1d3
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExW                                                                               0000000075c1b406 7 bytes JMP 000000016c12c0f4
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameW                                                                                  0000000075c37897 7 bytes JMP 000000016c12b87a
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameW                                                                              0000000075c37953 7 bytes JMP 000000016c12ba2b
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExA                                                                               0000000075c3a37a 7 bytes JMP 000000016c12c1ba
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                                0000000075c52642 5 bytes JMP 000000016c11a070
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameA                                                                                  0000000075c71d74 7 bytes JMP 000000016c12b932
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameA                                                                              0000000075c71e11 7 bytes JMP 000000016c12bae3
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusA                                                                                 0000000075c72201 7 bytes JMP 000000016c12c036
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesA                                                                              0000000075c722e4 7 bytes JMP 000000016c12b28a
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusW                                                                                 0000000075c72401 5 bytes JMP 000000016c12bf78
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoRegisterPSClsid                                                                                      0000000075ccc56e 5 bytes JMP 000000016c13196d
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                               0000000075ccea09 7 bytes JMP 000000016c131f3e
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!OleRun                                                                                                 0000000075cd07de 5 bytes JMP 000000016c131df9
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                                  0000000075cd21e1 5 bytes JMP 000000016c132a6e
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                                        0000000075cdeba1 6 bytes JMP 000000016c131d18
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                                          0000000075cdefd7 5 bytes JMP 000000016c131ca8
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoGetPSClsid                                                                                           0000000075ce26b9 5 bytes JMP 000000016c131ae5
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                                       0000000075cf54ad 5 bytes JMP 000000016c132ffc
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                                         0000000075d009ad 5 bytes JMP 000000016c131b58
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                                         0000000075d086d3 5 bytes JMP 000000016c131bda
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                       0000000075d09d0b 5 bytes JMP 000000016c1342ca
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                                     0000000075d09d4e 5 bytes JMP 000000016c132405
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                                              0000000075d2bb09 7 bytes JMP 000000016c131e69
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                                    0000000075d4eacf 5 bytes JMP 000000016c1313ca
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                                  0000000075d8340b 5 bytes JMP 000000016c1334bc
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                                    0000000075dccfd9 5 bytes JMP 000000016c131d83
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject                                                                                0000000075fb279e 5 bytes JMP 000000016c13165d
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\oleaut32.dll!RevokeActiveObject                                                                                  0000000075fb3294 5 bytes JMP 000000016c13177e
.text    C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[1208] C:\Windows\syswow64\oleaut32.dll!GetActiveObject                                                                                     0000000075fc8f40 5 bytes JMP 000000016c1317f1

---- Threads - GMER 2.1 ----

Thread   C:\Windows\System32\svchost.exe [296:5968]                                                                                                                                                                                            000007feedfb3efc
Thread   C:\Windows\System32\svchost.exe [296:1480]                                                                                                                                                                                            000007feee098a4c
Thread   C:\Windows\system32\svchost.exe [508:2132]                                                                                                                                                                                            000007fefac71ab0
Thread   C:\Windows\system32\svchost.exe [508:5540]                                                                                                                                                                                            000007fefac54164
Thread   C:\Windows\System32\spoolsv.exe [1596:3516]                                                                                                                                                                                           0000000000189390
Thread   C:\Windows\System32\spoolsv.exe [1596:3600]                                                                                                                                                                                           000007fef78910c8
Thread   C:\Windows\System32\spoolsv.exe [1596:3656]                                                                                                                                                                                           000007fef7856144
Thread   C:\Windows\System32\spoolsv.exe [1596:3668]                                                                                                                                                                                           000007fef9ab5fd0
Thread   C:\Windows\System32\spoolsv.exe [1596:3672]                                                                                                                                                                                           000007fef7443438
Thread   C:\Windows\System32\spoolsv.exe [1596:3676]                                                                                                                                                                                           000007fef9ab63ec
Thread   C:\Windows\System32\spoolsv.exe [1596:3692]                                                                                                                                                                                           000007fef8305e5c
Thread   C:\Windows\System32\spoolsv.exe [1596:3716]                                                                                                                                                                                           000007fef8325074
Thread   C:\Windows\System32\spoolsv.exe [1596:3784]                                                                                                                                                                                           000007fef8018760
Thread   C:\Windows\system32\svchost.exe [1680:1712]                                                                                                                                                                                           000007fefd4d1a70
Thread   C:\Windows\system32\svchost.exe [1680:1716]                                                                                                                                                                                           000007fefd4d1a70
Thread   C:\Windows\system32\svchost.exe [1680:1728]                                                                                                                                                                                           000007fefd4d1a70
Thread   C:\Windows\system32\svchost.exe [1680:1736]                                                                                                                                                                                           000007fefa172c70
Thread   C:\Windows\system32\svchost.exe [1680:1744]                                                                                                                                                                                           000007fefa17fb40
Thread   C:\Windows\system32\svchost.exe [1680:1756]                                                                                                                                                                                           000007fefa191d20
Thread   C:\Windows\system32\svchost.exe [1680:1760]                                                                                                                                                                                           000007fefa17f6f0
Thread   C:\Windows\system32\svchost.exe [1680:1996]                                                                                                                                                                                           000007fefa0a35c0
Thread   C:\Windows\system32\svchost.exe [1680:3908]                                                                                                                                                                                           000007fefa0a5600
Thread   C:\Windows\system32\svchost.exe [1680:3964]                                                                                                                                                                                           000007fef6e72940
Thread   C:\Windows\system32\svchost.exe [1680:4008]                                                                                                                                                                                           000007fef6e52888
Thread   C:\Windows\system32\svchost.exe [1680:4420]                                                                                                                                                                                           000007fef6e52a40
Thread   C:\Windows\system32\svchost.exe [1244:1068]                                                                                                                                                                                           000007fef9ab5fd0
Thread   C:\Windows\system32\svchost.exe [1244:2052]                                                                                                                                                                                           000007fef9ab63ec
Thread   C:\Windows\system32\svchost.exe [1244:860]                                                                                                                                                                                            000007feee638470
Thread   C:\Windows\system32\svchost.exe [1244:1828]                                                                                                                                                                                           000007feee642418
Thread   C:\Windows\system32\svchost.exe [1244:5856]                                                                                                                                                                                           000007feecdaf130
Thread   C:\Windows\system32\svchost.exe [1244:5872]                                                                                                                                                                                           000007feecda4734
Thread   C:\Windows\system32\svchost.exe [1244:2892]                                                                                                                                                                                           000007feecda4734
Thread   C:\Windows\Explorer.EXE [3476:3724]                                                                                                                                                                                                   000007fef6892154
Thread   C:\Windows\Explorer.EXE [3476:2352]                                                                                                                                                                                                   000007fef4042118
Thread   C:\Windows\Explorer.EXE [3476:4560]                                                                                                                                                                                                   000007fefb9d1010
Thread   C:\Windows\Explorer.EXE [3476:1204]                                                                                                                                                                                                   000007fefa432f9c
Thread   C:\Windows\Explorer.EXE [3476:5312]                                                                                                                                                                                                   000007fef4b0a3f8
Thread   C:\Windows\Explorer.EXE [3476:5892]                                                                                                                                                                                                   000007fefa432f9c
Thread   C:\Windows\Explorer.EXE [3476:4260]                                                                                                                                                                                                   000007fefa432f9c
Thread   C:\Windows\System32\svchost.exe [5364:6984]                                                                                                                                                                                           000007fef9769874
---- Processes - GMER 2.1 ----

Process  C:\Users\L***\Desktop\Gmer-19357.exe (*** suspicious ***) @ C:\Users\L***\Desktop\Gmer-19357.exe [4588](2014-02-10 18:30:54)                                                                                                          0000000000400000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ccaf78f7c38a                                                                                                                                                           
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ccaf78f7c38a (not active ControlSet)                                                                                                                                       

---- EOF - GMER 2.1 ----