GVU Trojaner löschen ohne abgesicherten Modus (farbars-recovery)

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by SYSTEM on MININT-96GTDAB on 17-03-2014 20:42:32
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1609296 2010-06-26] (Logitech, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\iTunes\iTunesHelper.exe [421736 2011-10-09] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573576 2012-12-10] (Ask)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\Dominik\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE [139264 2006-09-22] (SEIKO EPSON CORPORATION)
HKU\Jürg\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE [139264 2006-09-22] (SEIKO EPSON CORPORATION)
HKU\Jürg\...\Run: [] - [X]
HKU\Jürg\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1084840 2012-05-16] (Nokia)
HKU\Jürg\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe [3872080 2010-04-16] (Microsoft Corporation)
HKU\Jürg\...\Winlogon: [Shell] explorer.exe,C:\Users\Jürg\AppData\Roaming\skype.dat [65536 2011-11-17] () <==== ATTENTION 
Startup: C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jw7f1mq2.lnk
ShortcutTarget: jw7f1mq2.lnk -> C:\ProgramData\2qm1f7wj.cpp (Корпорация Майкрософт)
Startup: C:\Users\Jürg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Jürg.Home-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jw7f1mq2.lnk
ShortcutTarget: jw7f1mq2.lnk -> C:\ProgramData\2qm1f7wj.cpp (Корпорация Майкрософт)
Startup: C:\Users\Pädu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jw7f1mq2.lnk
ShortcutTarget: jw7f1mq2.lnk -> C:\ProgramData\2qm1f7wj.cpp (Корпорация Майкрософт)
Startup: C:\Users\Pädu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jw7f1mq2.lnk
ShortcutTarget: jw7f1mq2.lnk -> C:\ProgramData\2qm1f7wj.cpp (Корпорация Майкрософт)
Startup: C:\Users\Susanne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)
S2 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
S2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2011-03-31] ()
S2 TomTomHOMEService; D:\Programme\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143552 2012-02-09] (TuneUp Software)
S2 Winmgmt; C:\ProgramData\jw7f1mq2.zvv [332536 2014-03-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-31] (DT Soft Ltd)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 s1029bus; C:\Windows\System32\DRIVERS\s1029bus.sys [116264 2009-05-25] (MCCI Corporation)
S3 s1029mdfl; C:\Windows\System32\DRIVERS\s1029mdfl.sys [19496 2009-05-25] (MCCI Corporation)
S3 s1029mdm; C:\Windows\System32\DRIVERS\s1029mdm.sys [158760 2009-05-25] (MCCI Corporation)
S3 s1029mgmt; C:\Windows\System32\DRIVERS\s1029mgmt.sys [139304 2009-05-25] (MCCI Corporation)
S3 s1029nd5; C:\Windows\System32\DRIVERS\s1029nd5.sys [34856 2009-05-25] (MCCI Corporation)
S3 s1029obex; C:\Windows\System32\DRIVERS\s1029obex.sys [135208 2009-05-25] (MCCI Corporation)
S3 s1029unic; C:\Windows\System32\DRIVERS\s1029unic.sys [151592 2009-05-25] (MCCI Corporation)
S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-02-09] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-17 20:40 - 2014-03-17 20:42 - 00000000 ____D () C:\FRST
2014-03-17 19:31 - 2014-03-17 19:31 - 00003352 ____N () C:\bootsqm.dat
2014-03-14 15:35 - 2014-03-17 15:29 - 95027928 ____T () C:\ProgramData\jw7f1mq2.fee
2014-03-14 15:35 - 2014-03-14 15:35 - 00332536 ____T (Microsoft Corporation) C:\ProgramData\jw7f1mq2.zvv
2014-03-14 15:35 - 2014-03-14 15:35 - 00155648 _____ (Корпорация Майкрософт) C:\ProgramData\2qm1f7wj.cpp
2014-03-08 19:43 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-03-08 19:43 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-03-08 19:43 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-03-08 19:43 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-03-08 19:43 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-03-08 19:43 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-03-08 19:43 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-03-08 19:43 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-03-08 19:43 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-03-08 19:43 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-03-08 19:43 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-03-08 19:43 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-03-08 19:43 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-08 19:43 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-03-08 19:43 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-03-08 19:43 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-08 19:43 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-03-08 19:43 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-03-08 19:43 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-08 19:43 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-08 19:43 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-08 19:43 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-08 19:43 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-08 19:43 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-03-08 19:43 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-08 19:43 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-08 19:43 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-08 19:43 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-03-08 19:43 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-03-08 19:43 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-08 19:43 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-08 19:43 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-03-08 19:43 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-08 19:43 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-08 19:43 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-08 19:43 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-03-08 19:43 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-08 19:43 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-08 19:43 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-03-08 19:43 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-08 19:43 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-03-08 19:43 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2014-03-08 19:43 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-03-08 19:43 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-08 19:43 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-08 19:43 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\System32\wer.dll
2014-03-08 19:43 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-08 19:43 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\wwansvc.dll

==================== One Month Modified Files and Folders =======

2014-03-17 20:42 - 2014-03-17 20:40 - 00000000 ____D () C:\FRST
2014-03-17 20:21 - 2011-02-27 20:20 - 00327680 _____ () C:\Windows\System32\Ikeext.etl
2014-03-17 20:21 - 2009-07-14 05:45 - 00015152 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-17 20:21 - 2009-07-14 05:45 - 00015152 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-17 20:19 - 2012-12-03 16:27 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-17 20:19 - 2010-12-30 18:43 - 00198237 _____ () C:\Windows\setupact.log
2014-03-17 20:19 - 2010-08-31 00:18 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-17 20:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-17 20:15 - 2010-08-31 19:56 - 00000000 ____D () C:\Users\Dominik\Tracing
2014-03-17 20:07 - 2010-08-31 11:34 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CE28E2BC-84BF-4351-8BF1-66C9560AEE12}
2014-03-17 20:00 - 2011-02-20 15:17 - 00338418 _____ () C:\Windows\PFRO.log
2014-03-17 20:00 - 2010-08-31 08:17 - 00000000 ____D () C:\ProgramData\G DATA
2014-03-17 19:58 - 2010-08-30 23:35 - 01574254 _____ () C:\Windows\WindowsUpdate.log
2014-03-17 19:31 - 2014-03-17 19:31 - 00003352 ____N () C:\bootsqm.dat
2014-03-17 19:04 - 2012-07-23 17:51 - 00000000 ____D () C:\Users\Pädu\AppData\Roaming\Apple Computer
2014-03-17 16:18 - 2012-12-03 16:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-17 15:29 - 2014-03-14 15:35 - 95027928 ____T () C:\ProgramData\jw7f1mq2.fee
2014-03-17 15:26 - 2012-04-03 11:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-17 15:23 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-03-15 16:28 - 2013-08-15 15:16 - 00000000 ____D () C:\Windows\System32\MRT
2014-03-15 16:28 - 2010-09-07 19:50 - 90015360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-03-14 18:26 - 2010-09-01 11:22 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{63B9F0A4-B339-48C2-819D-DF3FEFDCA469}
2014-03-14 15:58 - 2010-08-30 23:45 - 00000000 ____D () C:\Users\Pädu\AppData\Local\VirtualStore
2014-03-14 15:35 - 2014-03-14 15:35 - 00332536 ____T (Microsoft Corporation) C:\ProgramData\jw7f1mq2.zvv
2014-03-14 15:35 - 2014-03-14 15:35 - 00155648 _____ (Корпорация Майкрософт) C:\ProgramData\2qm1f7wj.cpp
2014-03-14 15:27 - 2013-04-16 15:07 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-14 15:26 - 2012-04-03 11:16 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-14 15:26 - 2012-04-03 11:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-14 15:26 - 2011-05-16 11:16 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-14 15:13 - 2009-07-14 05:45 - 00305600 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-03-14 15:11 - 2013-03-13 18:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-14 15:11 - 2013-03-13 18:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-01 07:05 - 2014-03-08 19:43 - 23133696 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-03-01 06:17 - 2014-03-08 19:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-03-01 06:16 - 2014-03-08 19:43 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-08 19:43 - 02765824 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-03-01 05:52 - 2014-03-08 19:43 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-03-01 05:51 - 2014-03-08 19:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-08 19:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-03-01 05:40 - 2014-03-08 19:43 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-03-01 05:37 - 2014-03-08 19:43 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-03-01 05:33 - 2014-03-08 19:43 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-08 19:43 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-08 19:43 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-08 19:43 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-08 19:43 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-08 19:43 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-08 19:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-08 19:43 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-03-01 04:54 - 2014-03-08 19:43 - 05768704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-03-01 04:52 - 2014-03-08 19:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-08 19:43 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-08 19:43 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-08 19:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-08 19:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-08 19:43 - 00627200 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-03-01 04:40 - 2014-03-08 19:43 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-08 19:43 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-08 19:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-08 19:43 - 02041856 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-03-01 04:18 - 2014-03-08 19:43 - 13051904 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-03-01 04:16 - 2014-03-08 19:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-08 19:43 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-08 19:43 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-03-01 04:03 - 2014-03-08 19:43 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-08 19:43 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-08 19:43 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-08 19:43 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-03-01 03:32 - 2014-03-08 19:43 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-08 19:43 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-08 19:43 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-08 19:43 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-27 15:40 - 2010-10-09 23:00 - 01622836 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-27 15:40 - 2009-07-14 18:58 - 00709900 _____ () C:\Windows\System32\perfh007.dat
2014-02-27 15:40 - 2009-07-14 18:58 - 00154336 _____ () C:\Windows\System32\perfc007.dat
2014-02-27 15:40 - 2009-07-14 06:13 - 01622836 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-02-20 14:13 - 2012-12-03 16:27 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-20 14:13 - 2012-12-03 16:27 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

Files to move or delete:
====================
C:\Users\Jürg\AppData\Roaming\skype.dat
C:\Users\Jürg\AppData\Roaming\skype.ini
C:\ProgramData\hpe9646.dll
C:\ProgramData\jw7f1mq2.fee
C:\ProgramData\jw7f1mq2.zvv
C:\Users\Jürg\2687169.dll


Some content of TEMP:
====================
C:\Users\Dominik\AppData\Local\Temp\comver.dll
C:\Users\Dominik\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Dominik\AppData\Local\Temp\nvStereoApiI64.dll
C:\Users\Dominik\AppData\Local\Temp\nvStInst.exe
C:\Users\Dominik\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Jürg\AppData\Local\Temp\APNStub.exe
C:\Users\Jürg\AppData\Local\Temp\ICReinstall_DownloadManagerSetup.exe
C:\Users\Jürg\AppData\Local\Temp\ICReinstall_ICReinstall_DownloadManagerSetup.exe
C:\Users\Jürg\AppData\Local\Temp\NEventMessages.dll
C:\Users\Jürg\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Jürg\AppData\Local\Temp\r6Mjb52.exe
C:\Users\Jürg\AppData\Local\Temp\SIInvoker.exe
C:\Users\Jürg\AppData\Local\Temp\_is278E.exe
C:\Users\Jürg\AppData\Local\Temp\_is8F74.exe
C:\Users\Jürg.Home-PC\AppData\Local\Temp\~+JF2409106515266102857.dll
C:\Users\Pädu\AppData\Local\Temp\_isDA57.exe
C:\Users\Pädu\AppData\Local\Temp\_isE85B.exe
C:\Users\Pädu\AppData\Local\Temp\_isE91.exe
C:\Users\Pädu\AppData\Local\Temp\_isF2F5.exe
C:\Users\Susanne\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 4094.44 MB
Available physical RAM: 3435.67 MB
Total Pagefile: 4092.59 MB
Available Pagefile: 3430.9 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:279.45 GB) (Free:196.51 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Volume) (Fixed) (Total:931.51 GB) (Free:710.56 GB) NTFS
Drive e: (GDIS2014DE) (CDROM) (Total:0.58 GB) (Free:0 GB) CDFS
Drive g: (NIXON) (Removable) (Total:1.84 GB) (Free:1.61 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 279 GB) (Disk ID: 4F8CC212)
Partition 1: (Active) - (Size=279 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: 5628599E)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 2 GB) (Disk ID: DA3AF29F)

Partition: GPT Partition Type.


LastRegBack: 2013-12-12 20:42

==================== End Of Log ============================