Windows 7 // Firefox 27.0.1 Final // unerwünschte Pop-Ups und grüne hinterlegte Hyperlinks

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2014
Ran by Max (administrator) on MAX-PC on 11-03-2014 16:48:55
Running from C:\Users\Max\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\best-markit\best-markit_wd.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\Max\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Dropbox, Inc.) C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Program Files (x86)\best-markit\best-markit153.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Realtek) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWlan.exe
(STRATO) E:\Programme\STRATO HiDrive Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Program Files (x86)\veberGreat\bin\utilveberGreat.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(STRATO) E:\Programme\STRATO HiDrive.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\Root\Office15\WINWORD.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
() C:\Users\Max\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7191768 2013-06-27] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [630912 2012-05-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [12288 2012-04-19] ()
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [186408 2014-02-04] (Geek Software GmbH)
HKU\S-1-5-21-1218111978-3149465451-2471300371-1000\...\Run: [Spotify] - C:\Users\Max\AppData\Roaming\Spotify\Spotify.exe [6118400 2014-01-16] (Spotify Ltd)
HKU\S-1-5-21-1218111978-3149465451-2471300371-1000\...\Run: [Spotify Web Helper] - C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
HKU\S-1-5-21-1218111978-3149465451-2471300371-1000\...\MountPoints2: {2786e614-4d08-11e3-9634-d43d7eeb101c} - "F:\WD SmartWare.exe" autoplay=true
Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATO HiDrive.lnk
ShortcutTarget: STRATO HiDrive.lnk -> E:\Programme\STRATO HiDrive.exe (STRATO)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: veberGreat - {7d22614c-6dd5-4a12-8680-026be7220328} - C:\Program Files (x86)\veberGreat\veberGreatbho.dll (veberGreat)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Browser Utility - {d9f8ec5f-18a3-4f95-b7a9-0cc9b9c87a44} - C:\Program Files (x86)\Browser Utility\browserutility.dll (Browser Utility)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\c1imdjtn.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-11-03]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2014-02-04]
FF HKLM-x32\...\Firefox\Extensions: [{51c77233-c0ad-4220-8388-47c11c18b355}] - C:\Program Files (x86)\Browser Utility\browserutility.xpi
FF Extension: Browser Utility - C:\Program Files (x86)\Browser Utility\browserutility.xpi [2013-08-27]

Chrome: 
=======
CHR Extension: (No Name) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmlgoencnlndpglbocajlimaikjohmab [2014-02-28]
CHR HKLM-x32\...\Chrome\Extension: [eckmjheijoffjbjmkgggoclppgdlajfa] - C:\Program Files (x86)\Browser Utility\browserutility.crx [2013-08-27]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2012-09-23]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-05-04] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-23] (Avira Operations GmbH & Co. KG)
R2 best-markit; C:\Program Files (x86)\best-markit\best-markit153.exe [181248 2014-02-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation)
S3 OpenVPNService; E:\Program Files\OpenVPN\bin\openvpnserv.exe [37176 2013-08-22] (The OpenVPN Project)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2009-07-10] (Realtek)
R2 STRATO HiDrive Service; E:\Programme\STRATO HiDrive Service.exe [32768 2011-11-15] (STRATO)
S2 Update veberGreat; C:\Program Files (x86)\veberGreat\updateveberGreat.exe [111904 2014-02-27] ()
R2 Util veberGreat; C:\Program Files (x86)\veberGreat\bin\utilveberGreat.exe [111904 2014-02-28] ()

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [55936 2011-11-13] (Advanced Micro Devices)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2014-02-16] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2014-02-16] ()
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-11 16:48 - 2014-03-11 16:49 - 00015316 _____ () C:\Users\Max\Downloads\FRST.txt
2014-03-11 16:48 - 2014-03-11 16:48 - 02157056 _____ (Farbar) C:\Users\Max\Downloads\FRST64.exe
2014-03-11 16:48 - 2014-03-11 16:48 - 00000000 ____D () C:\FRST
2014-03-11 16:46 - 2014-03-11 16:46 - 00050477 _____ () C:\Users\Max\Downloads\Defogger.exe
2014-03-11 16:46 - 2014-03-11 16:46 - 00000468 _____ () C:\Users\Max\Downloads\defogger_disable.log
2014-03-11 16:46 - 2014-03-11 16:46 - 00000000 _____ () C:\Users\Max\defogger_reenable
2014-03-11 16:33 - 2014-03-11 16:33 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-11 16:33 - 2014-03-11 16:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-11 12:14 - 2014-03-11 12:14 - 00000000 ____D () C:\_OTL
2014-03-11 12:12 - 2014-03-11 12:12 - 00602112 _____ (OldTimer Tools) C:\Users\Max\Downloads\OTL.exe
2014-03-02 17:14 - 2014-03-02 17:14 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Farbglanz DPS
2014-03-02 17:12 - 2014-03-02 17:12 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FARBGLANZ Imaging
2014-03-02 17:06 - 2014-03-02 17:10 - 226349052 _____ (FARBGLANZ Imaging ) C:\Users\Max\Downloads\Win_Setup_DPS_2013(1).exe
2014-03-02 16:19 - 2014-03-11 16:18 - 00005120 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Max-PC-Max Max-PC
2014-02-28 16:27 - 2014-03-02 20:13 - 01591896 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-28 12:16 - 2014-02-28 12:16 - 00005748 _____ () C:\Users\Max\AppData\Local\recently-used.xbel
2014-02-28 12:07 - 2014-02-28 15:56 - 00000372 _____ () C:\Windows\cdplayer.ini
2014-02-28 12:06 - 2014-03-11 15:36 - 00000378 _____ () C:\Windows\Tasks\best-markit Update.job
2014-02-28 12:06 - 2014-03-11 15:33 - 00000378 _____ () C:\Windows\Tasks\best-markit_wd.job
2014-02-28 12:06 - 2014-02-28 12:07 - 00000000 ____D () C:\Program Files (x86)\Audiograbber
2014-02-28 12:06 - 2014-02-28 12:06 - 00504616 _____ () C:\Users\Max\Downloads\agsetup183se.exe
2014-02-28 12:06 - 2014-02-28 12:06 - 00003022 _____ () C:\Windows\System32\Tasks\best-markit Update
2014-02-28 12:06 - 2014-02-28 12:06 - 00002962 _____ () C:\Windows\System32\Tasks\best-markit_wd
2014-02-28 12:06 - 2014-02-28 12:06 - 00001127 _____ () C:\Users\Public\Desktop\Audiograbber.lnk
2014-02-28 12:06 - 2014-02-28 12:06 - 00000000 ____D () C:\Program Files (x86)\Browser Utility
2014-02-28 12:06 - 2014-02-28 12:06 - 00000000 ____D () C:\Program Files (x86)\best-markit
2014-02-28 11:53 - 2014-02-28 18:59 - 00000000 ____D () C:\Program Files (x86)\veberGreat
2014-02-28 11:53 - 2014-02-28 12:03 - 00000000 ____D () C:\Users\Max\AppData\Roaming\VOPackage
2014-02-28 11:53 - 2014-02-28 11:53 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Windows Net Data
2014-02-28 11:53 - 2014-02-28 11:53 - 00000000 ____D () C:\Users\Max\AppData\Local\Google
2014-02-28 11:52 - 2014-02-28 11:52 - 00504616 _____ () C:\Users\Max\Downloads\ag_setup183se.exe
2014-02-27 15:38 - 2014-02-27 15:38 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-02-27 15:37 - 2014-02-27 15:37 - 00000797 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-02-27 15:37 - 2014-02-27 15:37 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Canneverbe Limited
2014-02-27 15:36 - 2014-02-27 15:36 - 04986624 _____ (Canneverbe Limited ) C:\Users\Max\Downloads\cdbxp_setup_4.5.2.4478_minimal.exe
2014-02-16 10:25 - 2014-02-28 20:21 - 00000000 ____D () C:\Users\Max\Documents\Gothic3
2014-02-16 10:24 - 2014-02-16 10:24 - 00009933 _____ () C:\Windows\DirectX.log
2014-02-16 10:24 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-02-16 10:24 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-02-16 10:24 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-02-16 10:24 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-02-16 10:24 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-02-16 10:24 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-02-16 10:24 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-02-16 10:24 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-02-16 10:24 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-02-16 10:24 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-02-16 10:24 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-02-16 10:24 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-02-16 10:24 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-02-16 10:24 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-02-16 10:24 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-02-16 10:24 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-02-16 10:24 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-02-16 10:24 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-02-16 10:24 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-02-16 10:24 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-02-16 10:24 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-02-16 10:24 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-02-16 10:24 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-02-16 10:24 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-02-16 10:24 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-02-16 10:24 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-02-16 10:24 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-02-16 10:24 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-02-16 10:24 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-02-16 10:24 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-02-16 10:24 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-02-16 10:24 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-02-16 10:24 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-02-16 10:24 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-02-16 10:24 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-02-16 10:24 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-02-16 10:24 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-02-16 10:24 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-02-16 10:24 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-02-16 10:24 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-02-16 10:24 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-02-16 10:24 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-02-16 10:24 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-02-16 10:24 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-02-16 10:24 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-02-16 10:24 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-02-16 10:24 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-02-16 10:24 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-02-16 10:24 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-02-16 10:24 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-02-16 10:24 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-02-16 10:24 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-02-16 10:24 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-02-16 10:24 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-02-16 10:24 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-02-16 10:24 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-02-16 10:24 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-02-16 10:24 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-02-16 10:24 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-02-16 10:24 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-02-16 10:24 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-02-16 10:24 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-02-16 10:24 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-02-16 10:24 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-02-16 10:24 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-02-16 10:24 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-02-16 10:24 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-02-16 10:24 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-02-16 10:24 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-02-16 10:24 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-02-16 10:24 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-02-16 10:24 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-02-16 10:24 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-02-16 10:24 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-02-16 10:24 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-02-16 10:24 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-02-16 10:24 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-02-16 10:24 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-02-16 10:24 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-02-16 10:24 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-02-16 10:24 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-02-16 10:24 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-02-16 10:24 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-02-16 10:24 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-02-16 10:24 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-02-16 10:24 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-02-16 10:24 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-02-16 10:24 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-02-16 10:24 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-02-16 10:24 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-02-16 10:24 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-02-16 10:24 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-02-16 10:24 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-02-16 10:24 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-02-16 10:24 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-02-16 10:24 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-02-16 10:24 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-02-16 10:24 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-02-16 10:24 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-02-16 10:24 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-02-16 10:24 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-02-16 10:24 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-02-16 10:24 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-02-16 10:24 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-02-16 10:24 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-02-16 10:24 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-02-16 10:24 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-02-16 10:24 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-02-16 10:24 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-02-16 10:24 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-02-16 10:24 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-02-16 10:24 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-02-16 10:24 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-02-16 10:24 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-02-16 10:24 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-02-16 10:24 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-02-16 10:24 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-02-16 10:24 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-02-16 10:24 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-02-16 10:24 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-02-16 10:24 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-02-16 10:24 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-02-16 10:24 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-02-16 10:24 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-02-16 10:24 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-02-16 10:24 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-02-16 10:23 - 2014-02-16 10:23 - 00000550 _____ () C:\Windows\KB893803v2.log
2014-02-16 09:57 - 2014-02-16 10:18 - 1588960797 _____ (Nordic Games GmbH ) C:\Users\Max\Downloads\Gothic_3_EE_Patch_v1.75.14_Int_Full.exe
2014-02-16 09:51 - 2014-02-16 09:51 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-02-16 09:50 - 2014-02-16 09:50 - 00303616 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-02-16 09:50 - 2014-02-16 09:50 - 00035328 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-02-14 17:35 - 2014-02-14 17:35 - 00000000 ____D () C:\Users\Max\AppData\Roaming\PDAppFlex
2014-02-14 17:17 - 2014-02-14 17:17 - 00000000 ____D () C:\Users\Max\Documents\Benutzerdefinierte Office-Vorlagen
2014-02-13 20:28 - 2014-02-13 20:28 - 00002172 _____ () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00002124 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00002124 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ___RD () C:\Users\Max\SkyDrive
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-02-13 20:18 - 2014-02-13 20:18 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-02-13 20:10 - 2014-02-13 20:11 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-02-13 20:10 - 2014-02-13 20:10 - 00575168 _____ (Microsoft Corporation) C:\Users\Max\Downloads\Setup.X86.de-DE_O365HomePremRetail_fedf37ff-c64c-4709-931e-aefc894afe6e_TX_DB_.exe
2014-02-12 22:32 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 22:32 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 22:31 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 22:31 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 22:31 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 22:31 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 22:31 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 22:31 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 22:31 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 22:31 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 22:31 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 22:31 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 22:31 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 22:31 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 22:31 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 22:31 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 22:31 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 22:31 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 22:31 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 22:31 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 22:31 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 22:31 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 22:31 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 22:31 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 22:31 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 22:31 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 22:31 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 22:31 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 22:31 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 22:31 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 22:31 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 22:31 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 22:31 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 22:31 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 22:31 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 22:31 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 22:31 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 22:31 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 22:31 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 22:31 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 22:31 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 17:13 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 17:13 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 17:13 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 17:13 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 17:13 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 17:13 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 17:13 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 17:13 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 17:13 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 17:13 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 17:13 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 17:13 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 17:13 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 17:13 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 17:13 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 17:13 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 17:13 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 17:13 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 17:13 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 17:13 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 17:13 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 17:13 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 17:13 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 17:13 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 17:13 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 17:13 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 17:13 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 17:13 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

==================== One Month Modified Files and Folders =======

2014-03-11 16:49 - 2014-03-11 16:48 - 00015316 _____ () C:\Users\Max\Downloads\FRST.txt
2014-03-11 16:48 - 2014-03-11 16:48 - 02157056 _____ (Farbar) C:\Users\Max\Downloads\FRST64.exe
2014-03-11 16:48 - 2014-03-11 16:48 - 00000000 ____D () C:\FRST
2014-03-11 16:46 - 2014-03-11 16:46 - 00050477 _____ () C:\Users\Max\Downloads\Defogger.exe
2014-03-11 16:46 - 2014-03-11 16:46 - 00000468 _____ () C:\Users\Max\Downloads\defogger_disable.log
2014-03-11 16:46 - 2014-03-11 16:46 - 00000000 _____ () C:\Users\Max\defogger_reenable
2014-03-11 16:46 - 2013-11-03 15:43 - 00000000 ____D () C:\Users\Max
2014-03-11 16:45 - 2009-07-14 05:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-11 16:45 - 2009-07-14 05:45 - 00026672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-11 16:41 - 2013-11-03 15:43 - 01350994 _____ () C:\Windows\WindowsUpdate.log
2014-03-11 16:35 - 2013-11-03 18:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-11 16:33 - 2014-03-11 16:33 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-11 16:33 - 2014-03-11 16:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-11 16:33 - 2013-11-04 11:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-11 16:33 - 2013-11-03 18:52 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Mozilla
2014-03-11 16:18 - 2014-03-02 16:19 - 00005120 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Max-PC-Max Max-PC
2014-03-11 15:56 - 2013-11-03 15:43 - 00000000 ___RD () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-11 15:36 - 2014-02-28 12:06 - 00000378 _____ () C:\Windows\Tasks\best-markit Update.job
2014-03-11 15:34 - 2013-11-17 16:39 - 00000000 ___RD () C:\Users\Max\Dropbox
2014-03-11 15:34 - 2013-11-17 16:37 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Dropbox
2014-03-11 15:34 - 2013-11-10 19:40 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Spotify
2014-03-11 15:33 - 2014-02-28 12:06 - 00000378 _____ () C:\Windows\Tasks\best-markit_wd.job
2014-03-11 15:32 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-11 15:32 - 2009-07-14 05:51 - 00034441 _____ () C:\Windows\setupact.log
2014-03-11 12:14 - 2014-03-11 12:14 - 00000000 ____D () C:\_OTL
2014-03-11 12:12 - 2014-03-11 12:12 - 00602112 _____ (OldTimer Tools) C:\Users\Max\Downloads\OTL.exe
2014-03-10 17:36 - 2013-11-10 19:40 - 00000000 ____D () C:\Users\Max\AppData\Local\Spotify
2014-03-10 17:34 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-02 20:13 - 2014-02-28 16:27 - 01591896 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-02 20:13 - 2013-11-04 00:33 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2014-03-02 20:13 - 2013-11-04 00:33 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2014-03-02 20:13 - 2009-07-14 06:13 - 01591896 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-02 17:14 - 2014-03-02 17:14 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Farbglanz DPS
2014-03-02 17:12 - 2014-03-02 17:12 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FARBGLANZ Imaging
2014-03-02 17:10 - 2014-03-02 17:06 - 226349052 _____ (FARBGLANZ Imaging ) C:\Users\Max\Downloads\Win_Setup_DPS_2013(1).exe
2014-02-28 20:21 - 2014-02-16 10:25 - 00000000 ____D () C:\Users\Max\Documents\Gothic3
2014-02-28 18:59 - 2014-02-28 11:53 - 00000000 ____D () C:\Program Files (x86)\veberGreat
2014-02-28 18:59 - 2010-11-21 04:47 - 00215704 _____ () C:\Windows\PFRO.log
2014-02-28 18:59 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-02-28 15:56 - 2014-02-28 12:07 - 00000372 _____ () C:\Windows\cdplayer.ini
2014-02-28 12:18 - 2013-11-11 17:39 - 00000000 ____D () C:\Users\Max\.gimp-2.8
2014-02-28 12:16 - 2014-02-28 12:16 - 00005748 _____ () C:\Users\Max\AppData\Local\recently-used.xbel
2014-02-28 12:16 - 2013-11-21 09:47 - 00000000 ____D () C:\Users\Max\AppData\Local\gtk-2.0
2014-02-28 12:07 - 2014-02-28 12:06 - 00000000 ____D () C:\Program Files (x86)\Audiograbber
2014-02-28 12:06 - 2014-02-28 12:06 - 00504616 _____ () C:\Users\Max\Downloads\agsetup183se.exe
2014-02-28 12:06 - 2014-02-28 12:06 - 00003022 _____ () C:\Windows\System32\Tasks\best-markit Update
2014-02-28 12:06 - 2014-02-28 12:06 - 00002962 _____ () C:\Windows\System32\Tasks\best-markit_wd
2014-02-28 12:06 - 2014-02-28 12:06 - 00001127 _____ () C:\Users\Public\Desktop\Audiograbber.lnk
2014-02-28 12:06 - 2014-02-28 12:06 - 00000000 ____D () C:\Program Files (x86)\Browser Utility
2014-02-28 12:06 - 2014-02-28 12:06 - 00000000 ____D () C:\Program Files (x86)\best-markit
2014-02-28 12:04 - 2013-11-04 11:04 - 00000000 ____D () C:\Users\Max\AppData\Roaming\vlc
2014-02-28 12:03 - 2014-02-28 11:53 - 00000000 ____D () C:\Users\Max\AppData\Roaming\VOPackage
2014-02-28 11:53 - 2014-02-28 11:53 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Windows Net Data
2014-02-28 11:53 - 2014-02-28 11:53 - 00000000 ____D () C:\Users\Max\AppData\Local\Google
2014-02-28 11:52 - 2014-02-28 11:52 - 00504616 _____ () C:\Users\Max\Downloads\ag_setup183se.exe
2014-02-27 15:38 - 2014-02-27 15:38 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-02-27 15:37 - 2014-02-27 15:37 - 00000797 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-02-27 15:37 - 2014-02-27 15:37 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Canneverbe Limited
2014-02-27 15:36 - 2014-02-27 15:36 - 04986624 _____ (Canneverbe Limited ) C:\Users\Max\Downloads\cdbxp_setup_4.5.2.4478_minimal.exe
2014-02-23 15:35 - 2013-11-03 18:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-23 15:35 - 2013-11-03 18:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-23 15:35 - 2013-11-03 18:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-17 11:49 - 2013-11-03 23:51 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 11:48 - 2013-11-03 23:51 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 10:24 - 2014-02-16 10:24 - 00009933 _____ () C:\Windows\DirectX.log
2014-02-16 10:23 - 2014-02-16 10:23 - 00000550 _____ () C:\Windows\KB893803v2.log
2014-02-16 10:18 - 2014-02-16 09:57 - 1588960797 _____ (Nordic Games GmbH ) C:\Users\Max\Downloads\Gothic_3_EE_Patch_v1.75.14_Int_Full.exe
2014-02-16 09:51 - 2014-02-16 09:51 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-02-16 09:50 - 2014-02-16 09:50 - 00303616 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-02-16 09:50 - 2014-02-16 09:50 - 00035328 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-02-16 09:46 - 2013-11-03 17:05 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-14 17:35 - 2014-02-14 17:35 - 00000000 ____D () C:\Users\Max\AppData\Roaming\PDAppFlex
2014-02-14 17:35 - 2013-11-04 16:18 - 00000000 ____D () C:\Users\Max\AppData\Local\Adobe
2014-02-14 17:17 - 2014-02-14 17:17 - 00000000 ____D () C:\Users\Max\Documents\Benutzerdefinierte Office-Vorlagen
2014-02-14 16:12 - 2009-07-14 05:45 - 00495256 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-13 21:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 20:42 - 2013-11-03 17:13 - 00123384 _____ () C:\Users\Max\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-13 20:40 - 2013-11-27 08:57 - 00000000 ____D () C:\Users\Max\Documents\OneNote-Notizbücher
2014-02-13 20:28 - 2014-02-13 20:28 - 00002172 _____ () C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00002124 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00002124 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ___RD () C:\Users\Max\SkyDrive
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-02-13 20:28 - 2014-02-13 20:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-02-13 20:18 - 2014-02-13 20:18 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-02-13 20:18 - 2013-11-26 19:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-02-13 20:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-02-13 20:12 - 2013-11-03 15:43 - 00000000 ____D () C:\Users\Max\AppData\Local\VirtualStore
2014-02-13 20:11 - 2014-02-13 20:10 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-02-13 20:10 - 2014-02-13 20:10 - 00575168 _____ (Microsoft Corporation) C:\Users\Max\Downloads\Setup.X86.de-DE_O365HomePremRetail_fedf37ff-c64c-4709-931e-aefc894afe6e_TX_DB_.exe
2014-02-12 17:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

Some content of TEMP:
====================
C:\Users\Max\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-11 10:27

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2014
Ran by Max at 2014-03-11 16:49:31
Running from C:\Users\Max\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Acrobat XI Pro (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.00 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 2.00.0002 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.873.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{DD562794-C098-A1E5-66ED-10E8BD1C84C5}) (Version: 3.0.864.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2012.0504.1554.26509 - Ihr Firmenname) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.0504.1554.26509 - Ihr Firmenname) Hidden
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
best-markit (HKLM-x32\...\ae30b672-f2e9-4834-a57b-a64c8ae3e88c) (Version:  - best-markit Software)
Browser Utility (HKLM-x32\...\Browser Utility) (Version:  - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version:  - )
Catalyst Control Center InstallProxy (x32 Version: 2012.0504.1554.26509 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0504.1554.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0504.1553.26509 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0504.1554.26509 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CPUID CPU-Z 1.67 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Farbglanz DPS 2013 (HKLM-x32\...\Farbglanz DPS 2013) (Version: 2013 - FARBGLANZ Imaging)
FastStone Capture 5.3 (HKLM-x32\...\FastStone Capture) (Version: 5.3 - FastStone Soft)
GIMP 2.8.8 (HKLM\...\GIMP-2_is1) (Version: 2.8.8 - The GIMP Team)
Gothic III (HKLM-x32\...\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}) (Version: 1.0.0 - JoWooD Productions Software AG)
High-Definition Video Playback (x32 Version: 7.1.13900.47.0 - Nero AG) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
LAN Speed Test (HKLM-x32\...\{CE48BAE6-CDEF-4EB2-9AB0-67018F25C7C4}_is1) (Version: 3.4 - Totusoft) <==== ATTENTION
LibreOffice 4.1.1.2 (HKLM-x32\...\{F1EE568A-171F-4C06-9BE6-2395BED067A3}) (Version: 4.1.1.2 - The Document Foundation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 365 Home Premium - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4551.1512 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mumble 1.2.4 (HKLM-x32\...\{AF348C2E-7596-481B-92E0-B211836AB949}) (Version: 1.2.4 - Thorvald Natvig)
Nero 10 Movie ThemePack Basic (x32 Version: 10.2.10000.0.0 - Nero AG) Hidden
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.2.10500.1.102 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.2.11900.1.9 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.18400.9.0 - Nero AG) Hidden
Nero CoverDesigner 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Express 10 Help (CHM) (x32 Version: 10.5.10300 - Nero AG) Hidden
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.2.10400.5.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero MediaHub 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{ADEF1F0B-635E-4041-B50F-A510C1B4D2C5}) (Version: 10.5.10400 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.2.11600.14.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000 - Nero AG) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
OpenVPN 2.3.2  (HKLM\...\OpenVPN) (Version: 2.3.2 - )
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.3.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6959 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}) (Version: 1.00.0134 - REALTEK Semiconductor Corp.)
Skype™ 6.10 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.10.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.7.16.g4b197456 - Spotify AB)
STRATO HiDrive (remove only) (HKLM-x32\...\STRATO HiDrive) (Version:  - STRATO AG)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.18051 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
veberGreat (HKLM\...\veberGreat) (Version: 2014.02.27.004855 - veberGreat)
VIS (HKLM-x32\...\VIS) (Version:  - ) <==== ATTENTION
VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN)
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - )

==================== Restore Points  =========================

02-03-2014 19:12:09 Windows Update
11-03-2014 09:34:58 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {3484BF31-7BF7-4E1C-A51E-48A3225334AC} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-02-13] (Microsoft Corporation)
Task: {6A9F2AFC-15D3-4783-8A75-72FE9417A9F8} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Max-PC-Max Max-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-02-13] (Microsoft Corporation)
Task: {6B202543-A894-4EAE-9EB6-38BFFF1DE604} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-23] (Adobe Systems Incorporated)
Task: {7AC00165-2C4D-4332-9221-BEAFC4EB2FAC} - System32\Tasks\best-markit_wd => C:\Program Files (x86)\best-markit\best-markit_wd.exe [2014-02-28] ()
Task: {94F6896F-603E-492B-8A3E-B2E04074DDAF} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {B3F5549A-39D3-4D7A-A895-AF56F78267CB} - System32\Tasks\best-markit Update => C:\Program Files (x86)\best-markit\bestup.exe [2014-02-28] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\best-markit Update.job => C:\Program Files (x86)\best-markit\bestup.exe
Task: C:\Windows\Tasks\best-markit_wd.job => C:\Program Files (x86)\best-markit\best-markit_wd.exe

==================== Loaded Modules (whitelisted) =============

2014-02-28 12:06 - 2014-02-28 12:06 - 00093184 _____ () C:\Program Files (x86)\best-markit\best-markit_wd.exe
2013-11-10 19:40 - 2014-01-16 08:58 - 00603648 _____ () C:\Users\Max\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2014-02-28 12:06 - 2014-02-28 12:06 - 00181248 _____ () C:\Program Files (x86)\best-markit\best-markit153.exe
2014-02-13 20:10 - 2013-08-23 14:45 - 00386216 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2rui.dll
2014-02-13 20:10 - 2013-10-31 09:08 - 00520872 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2r64.dll
2014-02-13 20:10 - 2013-10-31 09:07 - 00618152 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2014-02-28 12:56 - 2014-02-28 12:56 - 00111904 _____ () C:\Program Files (x86)\veberGreat\bin\utilveberGreat.exe
2012-05-04 15:40 - 2012-05-04 15:40 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-05-04 15:47 - 2012-05-04 15:47 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-03-11 16:46 - 2014-03-11 16:46 - 00050477 _____ () C:\Users\Max\Downloads\Defogger.exe
2013-11-03 18:23 - 2013-06-20 14:48 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-11-10 19:40 - 2014-01-16 08:58 - 36967424 _____ () C:\Users\Max\AppData\Roaming\Spotify\Data\libcef.dll
2014-02-13 20:11 - 2014-02-13 20:11 - 00316584 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-02-13 20:11 - 2014-02-13 20:11 - 00359592 _____ () C:\Program Files\Microsoft Office 15\root\office15\c2r32.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Max\AppData\Roaming\Dropbox\bin\libcef.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2013-11-10 19:40 - 2014-01-16 08:58 - 00887808 _____ () C:\Users\Max\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-11-10 19:40 - 2014-01-16 08:58 - 00109568 _____ () C:\Users\Max\AppData\Roaming\Spotify\Data\libegl.dll
2013-11-03 18:37 - 2009-08-28 17:38 - 00131072 _____ () C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\EnumDevLib.dll
2014-02-05 18:23 - 2014-02-05 18:23 - 03019376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-02-05 18:23 - 2014-02-05 18:23 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-02-05 18:23 - 2014-02-05 18:23 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-02-13 20:11 - 2014-02-13 20:11 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2014-02-13 20:11 - 2014-02-13 20:11 - 00359592 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\c2r32.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00101888 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Locale\de_de\PDFMaker\PDFMOfficeAddin.DEU
2012-09-23 20:43 - 2012-09-23 20:43 - 00313992 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
2013-09-05 15:04 - 2013-09-05 15:04 - 14588632 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\NPSWF32.dll
2014-03-11 16:33 - 2014-02-13 01:36 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-23 15:35 - 2014-02-23 15:35 - 16265096 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/11/2014 03:35:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: STRATO HiDrive.exe, Version: 2.0.4335.33880, Zeitstempel: 0x4ec1a901
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x8b0
Startzeit der fehlerhaften Anwendung: 0xSTRATO HiDrive.exe0
Pfad der fehlerhaften Anwendung: STRATO HiDrive.exe1
Pfad des fehlerhaften Moduls: STRATO HiDrive.exe2
Berichtskennung: STRATO HiDrive.exe3

Error: (03/11/2014 03:35:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/11/2014 03:34:56 PM) (Source: .NET Runtime) (User: )
Description: Application: STRATO HiDrive.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.COMException
Stack:
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()
   at TrayApplication.StratoRegistry.GetDriveSerialNumber(System.String)
   at TrayApplication.StratoRegistry.GetRijndaelSimpleSaltValue()
   at TrayApplication.StratoRegistry..ctor()
   at TrayApplication.FormWork..ctor(System.Resources.ResourceManager)
   at TrayApplication.Program.Main(System.String[])

Error: (03/11/2014 00:19:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/11/2014 10:32:43 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (03/11/2014 08:41:00 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/11/2014 08:40:45 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: STRATO HiDrive.exe, Version: 2.0.4335.33880, Zeitstempel: 0x4ec1a901
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x8a8
Startzeit der fehlerhaften Anwendung: 0xSTRATO HiDrive.exe0
Pfad der fehlerhaften Anwendung: STRATO HiDrive.exe1
Pfad des fehlerhaften Moduls: STRATO HiDrive.exe2
Berichtskennung: STRATO HiDrive.exe3

Error: (03/11/2014 08:40:21 AM) (Source: .NET Runtime) (User: )
Description: Application: STRATO HiDrive.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.COMException
Stack:
   at System.Management.ManagementScope.Initialize()
   at System.Management.ManagementObjectSearcher.Initialize()
   at System.Management.ManagementObjectSearcher.Get()
   at TrayApplication.StratoRegistry.GetDriveSerialNumber(System.String)
   at TrayApplication.StratoRegistry.GetRijndaelSimpleSaltValue()
   at TrayApplication.StratoRegistry..ctor()
   at TrayApplication.FormWork..ctor(System.Resources.ResourceManager)
   at TrayApplication.Program.Main(System.String[])

Error: (03/10/2014 05:37:40 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/10/2014 05:37:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: STRATO HiDrive.exe, Version: 2.0.4335.33880, Zeitstempel: 0x4ec1a901
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1677
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x898
Startzeit der fehlerhaften Anwendung: 0xSTRATO HiDrive.exe0
Pfad der fehlerhaften Anwendung: STRATO HiDrive.exe1
Pfad des fehlerhaften Moduls: STRATO HiDrive.exe2
Berichtskennung: STRATO HiDrive.exe3


System errors:
=============
Error: (03/11/2014 04:32:21 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (03/11/2014 04:32:21 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (03/11/2014 03:35:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Util veberGreat" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/11/2014 03:34:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (03/11/2014 03:34:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (03/11/2014 00:19:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update veberGreat" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/11/2014 00:19:07 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Update veberGreat erreicht.

Error: (03/11/2014 00:18:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (03/11/2014 00:18:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (03/11/2014 08:40:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-03-11 15:34:34.126
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 15:34:34.001
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 15:34:33.518
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 15:34:33.455
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 12:18:06.424
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 12:18:06.299
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 12:18:06.096
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 12:18:06.018
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 08:40:00.689
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-11 08:40:00.486
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 65%
Total physical RAM: 3839.18 MB
Available physical RAM: 1313.91 MB
Total Pagefile: 7676.54 MB
Available Pagefile: 4595.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.66 GB) (Free:40.52 GB) NTFS
Drive e: (E) (Fixed) (Total:368 GB) (Free:362.25 GB) NTFS
Drive s: () (Network) (Total:97.66 GB) (Free:40.52 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: BD082F9C)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-11 17:07:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_DT01ACA050 rev.MS1OA750 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Max\AppData\Local\Temp\uwldypow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                         fffff80002df5000 63 bytes [00, 00, 51, 02, 54, 68, 72, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                                                                         fffff80002df5042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe[2068] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                                         0000000076b91465 2 bytes [B9, 76]
.text     C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe[2068] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                                        0000000076b914bb 2 bytes [B9, 76]
.text     ...                                                                                                                                                                                        * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000076b91465 2 bytes [B9, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              0000000076b914bb 2 bytes [B9, 76]
.text     ...                                                                                                                                                                                        * 2
.text     C:\Program Files (x86)\best-markit\best-markit153.exe[1964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                        0000000076b91465 2 bytes [B9, 76]
.text     C:\Program Files (x86)\best-markit\best-markit153.exe[1964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                       0000000076b914bb 2 bytes [B9, 76]
.text     ...                                                                                                                                                                                        * 2
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                 0000000077c0f9e0 5 bytes JMP 000000017520f270
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                               0000000077c0fa28 5 bytes JMP 000000017520f8d2
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                     0000000077c0fa40 5 bytes JMP 000000017520e00d
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                              0000000077c0fa90 5 bytes JMP 000000017520db69
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                         0000000077c0faa8 5 bytes JMP 000000017520de5a
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                             0000000077c0fb40 5 bytes JMP 000000017520fb12
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                    0000000077c0fc38 5 bytes JMP 000000017521accc
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                          0000000077c0fd4c 5 bytes JMP 000000017520d9b1
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                              0000000077c0fd64 5 bytes JMP 000000017521a2ee
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                    0000000077c0fd98 5 bytes JMP 000000017521a5e9
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                       0000000077c0fe44 5 bytes JMP 000000017520ee45
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                   0000000077c0fe5c 5 bytes JMP 000000017521a417
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                            0000000077c100b4 5 bytes JMP 000000017521a133
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                           0000000077c101c4 5 bytes JMP 000000017520e1b5
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtCreateKeyTransacted                                                                   0000000077c10754 5 bytes JMP 000000017520fbb4
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                            0000000077c109e4 5 bytes JMP 000000017521a32b
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                             0000000077c109fc 5 bytes JMP 000000017520d785
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                        0000000077c10a44 5 bytes JMP 000000017520e36b
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                              0000000077c10b80 5 bytes JMP 000000017520d89b
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                       0000000077c10f70 5 bytes JMP 000000017520e7f8
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                              0000000077c10f88 5 bytes JMP 000000017520e994
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                             0000000077c11018 5 bytes JMP 000000017520f95f
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransacted                                                                     0000000077c11030 5 bytes JMP 000000017520fa82
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransactedEx                                                                   0000000077c11048 5 bytes JMP 000000017520f9ef
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                               0000000077c1133c 5 bytes JMP 000000017521a500
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                 0000000077c1147c 5 bytes JMP 000000017520e66b
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                   0000000077c11528 5 bytes JMP 000000017520eb58
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                             0000000077c11718 5 bytes JMP 000000017520e4e3
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                     0000000077c11a58 5 bytes JMP 000000017520dd12
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                     0000000077c11b9c 5 bytes JMP 000000017520ecda
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                       000000007740103d 5 bytes JMP 00000001751f35da
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                       0000000077401072 5 bytes JMP 00000001751f3a3e
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                 000000007742c965 5 bytes JMP 00000001751f36f4
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\kernel32.dll!WinExec                                                                              0000000077482c51 5 bytes JMP 00000001751f3938
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                 0000000077002642 5 bytes JMP 00000001751f3c4b
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!OleLoadFromStream                                                                       0000000076996143 5 bytes JMP 0000000158e708cd
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                000000007699ea09 7 bytes JMP 000000017522e7f9
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!OleRun                                                                                  00000000769a07de 5 bytes JMP 000000017522e338
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                   00000000769a21e1 5 bytes JMP 0000000175231c0c
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                         00000000769aeba1 6 bytes JMP 000000017522e2af
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                           00000000769aefd7 5 bytes JMP 000000017522e267
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                        00000000769c54ad 5 bytes JMP 0000000175230282
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                          00000000769d09ad 5 bytes JMP 000000017522e207
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                          00000000769d86d3 5 bytes JMP 0000000175230c96
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                        00000000769d9d0b 5 bytes JMP 00000001752319b3
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                      00000000769d9d4e 5 bytes JMP 000000017522f891
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                               00000000769fbb09 7 bytes JMP 000000017522e380
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                     0000000076a1eacf 5 bytes JMP 000000017522ff46
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                   0000000076a5340b 5 bytes JMP 0000000175230d96
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                     0000000076a9cfd9 5 bytes JMP 000000017522e2f0
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\USER32.dll!RegisterClipboardFormatW                                                               00000000768a9ebd 5 bytes JMP 00000001583e4061
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\USER32.dll!RegisterClipboardFormatA                                                               00000000768b0afa 5 bytes JMP 00000001583e916f
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\USER32.dll!BeginPaint                                                                             00000000768b1361 5 bytes JMP 00000001583f7acc
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\USER32.dll!ValidateRect                                                                           00000000768b7849 5 bytes JMP 0000000158538c4c
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\SHELL32.dll!SHParseDisplayName                                                                    00000000759a7fab 5 bytes JMP 00000001585c7eb9
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!SysFreeString                                                                        0000000076d73e59 5 bytes JMP 000000015841ad9e
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!VariantClear                                                                         0000000076d73eae 5 bytes JMP 000000015842e9f7
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!SysAllocStringByteLen                                                                0000000076d74731 5 bytes JMP 00000001584e74a1
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!VariantChangeType                                                                    0000000076d75dee 5 bytes JMP 00000001584a5918
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject                                                                 0000000076da279e 1 byte JMP 00000001752308a2
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject + 2                                                             0000000076da27a0 3 bytes {JMP RAX}
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!RevokeActiveObject                                                                   0000000076da3294 5 bytes JMP 000000017522e1bf
.text     C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6816] C:\Windows\syswow64\oleaut32.dll!GetActiveObject                                                                      0000000076db8f40 5 bytes JMP 0000000175230a36
---- Processes - GMER 2.1 ----

Library   C:\Users\Max\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe [2068](2014-01-03 00:45:04)                          0000000003fe0000
Library   C:\Users\Max\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe [2068](2013-10-18 23:55:02)                                000000006b410000
Library   C:\Users\Max\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Max\AppData\Roaming\Dropbox\bin\Dropbox.exe [2068] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00)  000000006aa80000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                         00000000583c0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                    00000000662b0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\MSPTLS.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                      0000000066440000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\csi.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                         0000000062060000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\ACEOLEDB.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                    0000000065af0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACECORE.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                     000000005f7e0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\1031\ACEWSTR.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                0000000061f80000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACEES.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                       0000000064dd0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\VBAJET32.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                    0000000065ae0000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\expsrv.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                      0000000063e10000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACEERR.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6816]                      0000000061f60000

---- EOF - GMER 2.1 ----
         

Die Datei 'C:\Users\Max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2BS17N51\best-markit_2040-5390[1].exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55e1a858.qua' verschoben!