Windows 7: tbhcn im Systemstart

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Christoph (administrator) on VIET on 28-03-2014 23:16:33
Running from C:\Users\Christoph\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
() C:\windows\SysWOW64\PnkBstrA.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\windows\system32\NvCpl.dll [17412200 2010-05-05] (NVIDIA Corporation)
HKLM\...\Run: [THXCfg64] - C:\windows\system32\THXCfg64.dll [17920 2009-10-15] (Creative Technology Ltd.)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [635784 2010-01-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-03-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2486272 2010-06-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1349632 2010-05-16] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\Run: [Akamai NetSession Interface] - C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {4f0726ed-d555-11e0-aef6-406186ad220a} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {5e34f275-0eae-11e1-8b86-406186ad220a} - I:\AutoRun.exe
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b1568-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b1569-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b156b-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b156e-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b1570-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b1573-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {665b1575-0f5a-11e1-8ec9-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {76a00eda-27be-11e1-af9b-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {9940875d-2e25-11e1-8ce0-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {9940875f-2e25-11e1-8ce0-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {99408770-2e25-11e1-8ce0-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {9940877a-2e25-11e1-8ce0-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {a36ccdf0-e5a5-11e0-80b0-001e101f2b52} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {a36ccdf2-e5a5-11e0-80b0-001e101f2b52} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {a36ccdff-e5a5-11e0-80b0-001e101f2b52} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {a36cce01-e5a5-11e0-80b0-001e101f2b52} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {ac10499b-9f1c-11e0-afe7-bea48027ba40} - G:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {ac1049a4-9f1c-11e0-afe7-bea48027ba40} - I:\AutoRun.exe
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {acaf12e7-b8cd-11e0-8a18-406186ad220a} - G:\setup\rsrc\Autorun.exe
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {b29fd517-2e86-11e1-a4e6-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {e2e1482a-0f62-11e1-b278-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {f8c91c9d-0cbc-11e1-9f57-406186ad220a} - I:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2959067068-3289698165-731088358-1001\...\MountPoints2: {f8c91ca2-0cbc-11e1-9f57-406186ad220a} - I:\AutoRun.exe
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [95848 2010-05-05] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [90216 2010-05-05] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE10DEDE/WOL_WCP
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {380034B8-F238-4333-838A-E5EB888D7533} URL = 
SearchScopes: HKCU - {A5E7E3BF-B635-4287-B993-8A2C67E952C1} URL = 
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\vmvdpx0b.default
FF NewTab: www.google.com
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: www.google.com
FF Keyword.URL: https://www.google.com/search
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\vmvdpx0b.default\Extensions\staged [2014-03-25]
FF Extension: DownloadHelper - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\vmvdpx0b.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-20]
FF Extension: Adblock Edge - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\vmvdpx0b.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-01-21]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-12-05]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-07-15]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll ()
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.1.377\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Nitro PDF plugin for Firefox and Chrome) - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-06]
CHR Extension: (Google Drive) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-06]
CHR Extension: (YouTube) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-06]
CHR Extension: (Google-Suche) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-06]
CHR Extension: (AdBlock) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-14]
CHR Extension: (Google Wallet) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Mehr Leistung und Videoformate fr dein HTML5 video) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-08-06]
CHR Extension: (ShareMeNot) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\peeecebkcdlibcfllbpmmkhggflcppem [2013-10-14]
CHR Extension: (Google Mail) - C:\Users\Christoph\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-06]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-05] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
S4 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
R2 hasplms; C:\windows\system32\hasplms.exe [4889032 2011-12-30] (SafeNet Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2012-07-21] ()
S4 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-11] (Vodafone)

==================== Drivers (Whitelisted) ====================

S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-06-22] (DT Soft Ltd)
S3 EUCR; C:\Windows\system32\DRIVERS\EUCR6SK.SYS [87888 2009-12-05] (ENE Technology Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [321536 2011-09-28] (SafeNet Inc.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\msi\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [32496 2013-11-28] (Synaptics Incorporated)
S3 smserial; C:\Windows\System32\DRIVERS\SmSerl64.sys [1227776 2009-06-10] (Motorola Inc.)
R1 vmm; C:\windows\system32\Treiber\vmm.sys [294232 2011-11-19] (Microsoft Corporation)
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
S3 MGHwCtrl; \??\C:\Program Files\msi\msi Software Install\MGHwCtrl.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-28 23:16 - 2014-03-28 23:16 - 02157056 _____ (Farbar) C:\Users\Christoph\Downloads\FRST64.exe
2014-03-28 23:16 - 2014-03-28 23:16 - 00023539 _____ () C:\Users\Christoph\Downloads\FRST.txt
2014-03-28 23:16 - 2014-03-28 23:16 - 00000000 ____D () C:\FRST
2014-03-28 22:48 - 2014-03-28 22:48 - 00000020 ___SH () C:\Users\TEMP\ntuser.ini
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Vorlagen
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Startmenü
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Netzwerkumgebung
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Lokale Einstellungen
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Eigene Dateien
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Druckumgebung
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Musik
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Bilder
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Verlauf
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Anwendungsdaten
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Anwendungsdaten
2014-03-28 22:48 - 2013-11-09 03:03 - 00000000 ____D () C:\Users\TEMP\AppData\Local\Microsoft Help
2014-03-28 22:48 - 2011-06-22 22:22 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\Macromedia
2014-03-28 22:48 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-03-28 22:48 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-03-28 22:24 - 2014-03-28 22:24 - 03867224 _____ (Realtek Semiconductor Corp.) C:\windows\system32\Drivers\RTKVHD64.sys
2014-03-28 22:24 - 2014-03-28 22:24 - 02787544 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 02101848 _____ (Waves Audio Ltd.) C:\windows\system32\WavesGUILib64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 02037336 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioEQ64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 01286872 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RTCOM64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 01033304 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPOShell64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 00945880 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RCoInstII64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 00747989 _____ () C:\windows\system32\Drivers\RTAIODAT.DAT
2014-03-28 22:20 - 2014-03-28 22:20 - 00003166 _____ () C:\windows\System32\Tasks\Driver Booster Update
2014-03-28 22:20 - 2014-03-28 22:20 - 00002864 _____ () C:\windows\System32\Tasks\Driver Booster SkipUAC (Christoph)
2014-03-28 22:13 - 2014-03-28 22:14 - 00000063 _____ () C:\inst_auto2012.log
2014-03-23 23:21 - 2014-03-23 23:21 - 00267776 _____ () C:\Users\Christoph\Downloads\Wandel und Schichtung.ppt
2014-03-23 19:28 - 2014-03-25 22:29 - 00010351 _____ () C:\Users\Christoph\Desktop\Französisches Vokabular.xlsx
2014-03-23 19:28 - 2014-03-23 19:28 - 00008714 _____ () C:\Users\Christoph\Desktop\Englisches Vokabular.xlsx
2014-03-18 15:36 - 2014-03-18 15:36 - 02825432 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtPgEx64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 02770976 _____ (Fortemedia Corporation) C:\windows\system32\FMAPO64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 01022680 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkApi64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 00624344 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtDataProc64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 00397592 _____ (Creative Technology Ltd.) C:\windows\system32\MBWrp64.dll
2014-03-18 15:35 - 2014-03-18 15:35 - 11530992 _____ (Intel Corporation) C:\windows\system32\Drivers\NETwsw00.sys
2014-03-14 14:13 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-03-14 14:13 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-03-14 14:13 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-03-14 14:13 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-03-14 14:13 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-03-14 14:13 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-03-14 14:13 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-03-14 14:13 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-03-14 14:13 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-03-14 14:13 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-03-14 14:13 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-03-14 14:13 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-03-14 14:13 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-03-14 14:13 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-03-14 14:13 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-03-14 14:13 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-03-14 14:13 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-03-14 14:13 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-03-14 14:13 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-03-14 14:13 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-03-14 14:13 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-03-14 14:13 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-03-14 14:13 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-03-14 14:13 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-03-14 14:13 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-03-14 14:13 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-03-14 14:13 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-03-14 14:13 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-03-14 14:13 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-03-14 14:13 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-03-14 14:13 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-03-14 14:13 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-03-14 14:13 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-03-14 14:13 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-03-14 14:13 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-03-14 14:13 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-03-14 14:13 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-03-14 14:13 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-03-14 14:13 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-03-14 14:13 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-03-14 14:13 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-03-14 14:13 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2014-03-14 14:13 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2014-03-14 14:13 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2014-03-14 14:12 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-03-14 14:12 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2014-03-14 14:12 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-03-14 14:12 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2014-03-06 21:38 - 2014-03-06 21:38 - 00010996 _____ () C:\Users\Christoph\Documents\cc_20140306_213757.reg
2014-03-04 13:32 - 2014-03-06 21:30 - 00161848 _____ () C:\Users\Christoph\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-04 13:31 - 2014-03-28 22:46 - 00009420 _____ () C:\windows\PFRO.log
2014-03-04 13:31 - 2014-03-28 22:46 - 00003398 _____ () C:\windows\setupact.log
2014-03-04 13:31 - 2014-03-14 21:07 - 00540512 _____ () C:\windows\system32\FNTCACHE.DAT
2014-03-04 13:31 - 2014-03-04 13:31 - 00000000 _____ () C:\windows\setuperr.log
2014-02-28 04:45 - 2014-02-28 04:45 - 00000000 ____D () C:\windows\ERUNT
2014-02-28 04:26 - 2014-02-28 04:43 - 00000000 ____D () C:\AdwCleaner
2014-02-28 02:26 - 2014-02-28 02:26 - 00000000 _____ () C:\autoexec.bat
2014-02-28 02:25 - 2014-02-28 02:25 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-02-28 02:24 - 2014-02-28 02:32 - 00000000 ____D () C:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-02-28 02:04 - 2012-07-25 12:03 - 00016896 _____ () C:\windows\system32\sasnative64.exe
2014-02-27 21:02 - 2012-07-05 21:06 - 00772544 _____ (Oracle Corporation) C:\windows\SysWOW64\npDeployJava1.dll
2014-02-27 21:02 - 2012-07-05 21:06 - 00687544 _____ (Oracle Corporation) C:\windows\SysWOW64\deployJava1.dll
2014-02-27 21:00 - 2014-02-27 21:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-27 21:00 - 2014-02-27 20:59 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-27 20:50 - 2014-02-27 20:50 - 00602112 _____ (OldTimer Tools) C:\Users\Christoph\Desktop\OTL.exe
2014-02-27 18:27 - 2014-02-27 18:28 - 00002730 _____ () C:\Users\Christoph\Documents\cc_20140227_182755.reg
2014-02-27 18:27 - 2014-02-27 18:27 - 00001079 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Malwarebytes
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-27 18:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

==================== One Month Modified Files and Folders =======

2014-03-28 23:16 - 2014-03-28 23:16 - 02157056 _____ (Farbar) C:\Users\Christoph\Downloads\FRST64.exe
2014-03-28 23:16 - 2014-03-28 23:16 - 00023539 _____ () C:\Users\Christoph\Downloads\FRST.txt
2014-03-28 23:16 - 2014-03-28 23:16 - 00000000 ____D () C:\FRST
2014-03-28 23:12 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing
2014-03-28 23:08 - 2012-06-14 21:59 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-03-28 23:05 - 2014-02-24 04:02 - 00000000 ____D () C:\Program Files (x86)\Digitale Bibliothek 5
2014-03-28 23:05 - 2012-08-06 21:43 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\.minecraft
2014-03-28 23:01 - 2011-06-21 17:27 - 01755531 _____ () C:\windows\WindowsUpdate.log
2014-03-28 22:56 - 2009-07-14 05:45 - 00017600 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-28 22:56 - 2009-07-14 05:45 - 00017600 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-28 22:48 - 2014-03-28 22:48 - 00000020 ___SH () C:\Users\TEMP\ntuser.ini
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Vorlagen
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Startmenü
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Netzwerkumgebung
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Lokale Einstellungen
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Eigene Dateien
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Druckumgebung
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Musik
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Documents\Eigene Bilder
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Verlauf
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\AppData\Local\Anwendungsdaten
2014-03-28 22:48 - 2014-03-28 22:48 - 00000000 _SHDL () C:\Users\TEMP\Anwendungsdaten
2014-03-28 22:46 - 2014-03-04 13:31 - 00009420 _____ () C:\windows\PFRO.log
2014-03-28 22:46 - 2014-03-04 13:31 - 00003398 _____ () C:\windows\setupact.log
2014-03-28 22:46 - 2013-07-16 12:25 - 00065536 _____ () C:\windows\system32\Ikeext.etl
2014-03-28 22:46 - 2012-01-14 18:00 - 00000000 ____D () C:\Program Files (x86)\Pando Networks
2014-03-28 22:46 - 2011-11-15 13:38 - 00001112 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-28 22:46 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-03-28 22:33 - 2013-10-28 23:38 - 00000000 ____D () C:\Users\Christoph\Desktop\Playlist 2013
2014-03-28 22:30 - 2011-11-15 13:38 - 00001116 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-28 22:26 - 2012-05-27 20:36 - 00000000 ____D () C:\windows\SysWOW64\RTCOM
2014-03-28 22:24 - 2014-03-28 22:24 - 03867224 _____ (Realtek Semiconductor Corp.) C:\windows\system32\Drivers\RTKVHD64.sys
2014-03-28 22:24 - 2014-03-28 22:24 - 02787544 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 02101848 _____ (Waves Audio Ltd.) C:\windows\system32\WavesGUILib64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 02037336 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioEQ64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 01286872 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RTCOM64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 01033304 _____ (Waves Audio Ltd.) C:\windows\system32\MaxxAudioAPOShell64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 00945880 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RCoInstII64.dll
2014-03-28 22:24 - 2014-03-28 22:24 - 00747989 _____ () C:\windows\system32\Drivers\RTAIODAT.DAT
2014-03-28 22:20 - 2014-03-28 22:20 - 00003166 _____ () C:\windows\System32\Tasks\Driver Booster Update
2014-03-28 22:20 - 2014-03-28 22:20 - 00002864 _____ () C:\windows\System32\Tasks\Driver Booster SkipUAC (Christoph)
2014-03-28 22:20 - 2014-01-21 15:48 - 00001140 _____ () C:\Users\Public\Desktop\Driver Booster.lnk
2014-03-28 22:20 - 2013-10-09 19:25 - 00003222 _____ () C:\windows\System32\Tasks\Driver Booster Scan
2014-03-28 22:20 - 2011-11-15 22:27 - 00004154 _____ () C:\windows\vpd.properties
2014-03-28 22:20 - 2011-11-15 22:27 - 00000000 ____D () C:\Program Files (x86)\Dialogys
2014-03-28 22:14 - 2014-03-28 22:13 - 00000063 _____ () C:\inst_auto2012.log
2014-03-28 22:14 - 2010-06-12 03:08 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-28 22:10 - 2012-08-12 21:09 - 00000000 ____D () C:\Program Files\EslWire
2014-03-28 22:09 - 2013-12-15 00:51 - 00000000 ____D () C:\Program Files (x86)\jose
2014-03-28 19:36 - 2012-07-17 21:43 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-26 19:03 - 2012-08-24 23:07 - 00000000 ____D () C:\Program Files (x86)\Heroes of Newerth
2014-03-26 13:37 - 2012-05-29 17:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-25 23:17 - 2012-12-05 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-25 22:29 - 2014-03-23 19:28 - 00010351 _____ () C:\Users\Christoph\Desktop\Französisches Vokabular.xlsx
2014-03-24 15:08 - 2009-07-14 06:08 - 00032640 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-03-23 23:21 - 2014-03-23 23:21 - 00267776 _____ () C:\Users\Christoph\Downloads\Wandel und Schichtung.ppt
2014-03-23 19:28 - 2014-03-23 19:28 - 00008714 _____ () C:\Users\Christoph\Desktop\Englisches Vokabular.xlsx
2014-03-19 02:20 - 2010-06-12 02:26 - 00701368 _____ () C:\windows\system32\perfh007.dat
2014-03-19 02:20 - 2010-06-12 02:26 - 00150516 _____ () C:\windows\system32\perfc007.dat
2014-03-19 02:20 - 2009-07-14 06:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-03-18 15:36 - 2014-03-18 15:36 - 02825432 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtPgEx64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 02770976 _____ (Fortemedia Corporation) C:\windows\system32\FMAPO64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 01022680 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkApi64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 00624344 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtDataProc64.dll
2014-03-18 15:36 - 2014-03-18 15:36 - 00397592 _____ (Creative Technology Ltd.) C:\windows\system32\MBWrp64.dll
2014-03-18 15:35 - 2014-03-18 15:35 - 11530992 _____ (Intel Corporation) C:\windows\system32\Drivers\NETwsw00.sys
2014-03-18 03:03 - 2013-08-09 19:31 - 00000000 ____D () C:\windows\system32\MRT
2014-03-18 03:00 - 2012-02-10 21:46 - 90015360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-03-16 01:19 - 2012-02-25 17:42 - 00282472 _____ () C:\windows\SysWOW64\PnkBstrB.xtr
2014-03-16 01:19 - 2012-02-25 14:52 - 00282472 _____ () C:\windows\SysWOW64\PnkBstrB.exe
2014-03-16 01:18 - 2012-02-25 14:52 - 00282472 _____ () C:\windows\SysWOW64\PnkBstrB.ex0
2014-03-15 12:52 - 2012-12-21 19:56 - 00002145 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-14 21:07 - 2014-03-04 13:31 - 00540512 _____ () C:\windows\system32\FNTCACHE.DAT
2014-03-14 14:30 - 2013-11-08 01:44 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-12 16:08 - 2012-06-14 21:59 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 16:08 - 2012-06-14 21:59 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 16:08 - 2011-06-21 22:05 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-06 21:38 - 2014-03-06 21:38 - 00010996 _____ () C:\Users\Christoph\Documents\cc_20140306_213757.reg
2014-03-06 21:30 - 2014-03-04 13:32 - 00161848 _____ () C:\Users\Christoph\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-04 13:41 - 2011-07-31 08:41 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-04 13:41 - 2011-07-31 08:41 - 00000000 ____D () C:\ProgramData\Skype
2014-03-04 13:31 - 2014-03-04 13:31 - 00000000 _____ () C:\windows\setuperr.log
2014-03-04 01:33 - 2011-10-11 21:00 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\TS3Client
2014-03-01 07:05 - 2014-03-14 14:13 - 23133696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-03-01 06:17 - 2014-03-14 14:13 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-03-01 06:16 - 2014-03-14 14:13 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-14 14:13 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-03-01 05:52 - 2014-03-14 14:13 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-03-01 05:51 - 2014-03-14 14:13 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-14 14:13 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-03-01 05:40 - 2014-03-14 14:13 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-03-01 05:37 - 2014-03-14 14:13 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-03-01 05:33 - 2014-03-14 14:13 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-14 14:13 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-14 14:13 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-14 14:13 - 17074688 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-14 14:13 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-14 14:13 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-14 14:13 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-14 14:13 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-03-01 04:54 - 2014-03-14 14:13 - 05768704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-03-01 04:52 - 2014-03-14 14:13 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-14 14:13 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-14 14:13 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-14 14:13 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-14 14:13 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-14 14:13 - 00627200 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-03-01 04:40 - 2014-03-14 14:13 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-14 14:13 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-14 14:13 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-14 14:13 - 02041856 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-03-01 04:18 - 2014-03-14 14:13 - 13051904 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-03-01 04:16 - 2014-03-14 14:13 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-14 14:13 - 04244480 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-14 14:13 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-03-01 04:03 - 2014-03-14 14:13 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-14 14:13 - 01964032 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-14 14:13 - 11266048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-14 14:13 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-03-01 03:32 - 2014-03-14 14:13 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-14 14:13 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-14 14:13 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-14 14:13 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-02-28 04:45 - 2014-02-28 04:45 - 00000000 ____D () C:\windows\ERUNT
2014-02-28 04:43 - 2014-02-28 04:26 - 00000000 ____D () C:\AdwCleaner
2014-02-28 02:32 - 2014-02-28 02:24 - 00000000 ____D () C:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-02-28 02:26 - 2014-02-28 02:26 - 00000000 _____ () C:\autoexec.bat
2014-02-28 02:25 - 2014-02-28 02:25 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-02-28 01:56 - 2012-06-30 23:54 - 00000000 ____D () C:\windows\pss
2014-02-28 01:56 - 2011-06-21 17:38 - 00000000 ___RD () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-27 21:00 - 2014-02-27 21:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-27 20:59 - 2014-02-27 21:00 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-02-27 20:59 - 2014-02-27 20:59 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-27 20:50 - 2014-02-27 20:50 - 00602112 _____ (OldTimer Tools) C:\Users\Christoph\Desktop\OTL.exe
2014-02-27 18:36 - 2013-10-07 22:40 - 00000000 ____D () C:\Users\Christoph\Desktop\Schule
2014-02-27 18:28 - 2014-02-27 18:27 - 00002730 _____ () C:\Users\Christoph\Documents\cc_20140227_182755.reg
2014-02-27 18:27 - 2014-02-27 18:27 - 00001079 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Malwarebytes
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 18:27 - 2014-02-27 18:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-27 18:06 - 2012-12-21 19:56 - 00000000 ____D () C:\Program Files\CCleaner
2014-02-27 05:16 - 2014-02-24 04:33 - 00000000 ____D () C:\Users\Christoph\Desktop\images
2014-02-26 03:04 - 2011-07-28 05:35 - 01598840 _____ () C:\windows\SysWOW64\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Users\Christoph\AppData\Local\Temp\avgnt.exe
C:\Users\Christoph\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-20 14:28

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Christoph at 2014-03-28 23:17:19
Running from C:\Users\Christoph\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.0.0.4080 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{24762012-C6C8-4AAD-A02D-71A009FA1683}) (Version: 10.0.42.34 - Adobe Systems, Inc.)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Akamai NetSession Interface Service (HKLM-x32\...\Akamai) (Version:  - Akamai Technologies, Inc)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{8E90189A-A5D4-4C0E-A908-06C4236F98EE}) (Version: 2.0.10.94 - ArcSoft)
ArcSoft Print Creations - Album Page (HKLM-x32\...\{E6B4117F-AC59-4B13-9274-EB136E8897EE}) (Version:  - ArcSoft)
ArcSoft Print Creations - Brochures & Flyers (HKLM-x32\...\{01A1A019-E1D8-482A-BE17-5E118D17C0A0}) (Version:  - ArcSoft)
ArcSoft Print Creations - Funhouse (HKLM-x32\...\{9591C049-5CAE-4E89-A8D9-191F1899628B}) (Version:  - ArcSoft)
ArcSoft Print Creations - Funhouse II (HKLM-x32\...\{3CE47E6B-AE27-4E40-AC54-329EED96B933}) (Version:  - ArcSoft)
ArcSoft Print Creations - Greeting Card (HKLM-x32\...\{F04F9557-81A9-4293-BC49-2C216FA325A7}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Book (HKLM-x32\...\{56589DFE-0C29-4DFE-8E42-887B771ECD23}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Calendar (HKLM-x32\...\{CA9ED5E4-1548-485B-A293-417840060158}) (Version:  - ArcSoft)
ArcSoft Print Creations - Photo Prints (HKLM-x32\...\{95F875CC-1B85-43E6-B3E0-13EA04F3D995}) (Version:  - ArcSoft)
ArcSoft Print Creations - Poster Creator (HKLM-x32\...\{5D1C82E7-7EC0-4404-A8AD-36C3B444BC34}) (Version:  - ArcSoft)
ArcSoft Print Creations - Scrapbook (HKLM-x32\...\{B0D83FCD-9D42-43ED-8315-250326AADA02}) (Version:  - ArcSoft)
ArcSoft Print Creations - Slimline Card (HKLM-x32\...\{007B37D9-0C45-4202-834B-DD5FAAE99D63}) (Version:  - ArcSoft)
ArcSoft Print Creations (HKLM-x32\...\{A3324BBB-3A83-40CE-AA8C-759D849B7EA1}) (Version: 3.0.255.487 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{25478065-4CB1-448C-80E4-8C4529017EE3}) (Version: 3.0.32.354 - ArcSoft)
AutoCAD LT 2012 - Deutsch (HKLM\...\AutoCAD LT 2012 - Deutsch) (Version: 18.2.51.0 - Autodesk)
AutoCAD LT 2012 - Deutsch (Version: 18.2.51.0 - Autodesk) Hidden
AutoCAD LT 2012 Language Pack - Deutsch (Version: 18.2.51.0 - Autodesk) Hidden
Autodesk Content Service (HKLM-x32\...\{086F9A69-CD39-4893-A9FB-D3A0634CE3F7}) (Version: 2.0.90 - Autodesk)
Autodesk Material Library 2012 (HKLM-x32\...\{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}) (Version: 2.5.0.8 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2012 (HKLM-x32\...\{65420DC9-306E-4371-905F-F4DC3B418E52}) (Version: 2.5.0.8 - Autodesk)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BurnRecovery (HKLM-x32\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.912.401 - Micro-Star International Co., Ltd.)
Call of Duty(R) - World at War(TM) (HKLM-x32\...\InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}) (Version: 1.0 - Activision)
Call of Duty(R) - World at War(TM) (x32 Version: 1.0 - Activision) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) (HKLM-x32\...\InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}) (Version: 1.7 - Activision)
Call of Duty(R) 4 - Modern Warfare(TM) (x32 Version: 1.00.0000 - Activision) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch (x32 Version:  - ) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch (x32 Version: 1.6 - Activision) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version:  - ) Hidden
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch (x32 Version: 1.7 - Activision) Hidden
Camera Recorder (HKLM-x32\...\{3BDDA587-7CDE-430C-90A4-E2C4E48D3AE9}) (Version: 1.0.909.0801 - Camera Recorder)
CASIO FA-124 (HKLM-x32\...\{FB47E710-6249-4EFA-BE36-E922B0612AF4}) (Version: 2.00.0001 - CASIO COMPUTER CO., LTD.)
CCleaner (HKLM\...\CCleaner) (Version: 3.26 - Piriform)
CodeSite Express 5.1.1 (HKLM-x32\...\CodeSite Express 5.1.1) (Version: 5.1 - Raize Software, Inc.)
CollabNet Subversion Client 1.7.5 (HKLM-x32\...\CollabNet Subversion Client) (Version: 1.7.5 - CollabNet)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - )
Counter-Strike: Source (HKLM-x32\...\Counter-Strike: Source) (Version:  - Valve)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.40.2.0131 - DT Soft Ltd)
DevJET Documentation Insight Express Edition V2.1.8.25 (HKLM-x32\...\{F62B6FC9-BECA-4209-9F8E-09528DC143BE}_is1) (Version:  - DevJET)
DivX-Setup (HKLM-x32\...\DivX Setup.divx.com) (Version: 2.5.0.15 - DivX, LLC)
Dolphin (HKLM-x32\...\Dolphin) (Version: 4.0.1 - Dolphin Development Team)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - )
Driver Booster (HKLM-x32\...\Driver Booster_is1) (Version: 1.3 - IObit)
ETDWare PS/2-x64 7.0.5.10_WHQL (HKLM\...\Elantech) (Version: 7.0.5.10 - ELAN Microelectronics Corp.)
Festo FluidSim 3.6 (HKLM-x32\...\Festo Fluidsim_is1) (Version:  - My Company, Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.14.1022 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.14.1022 - DVDVideoSoft Ltd.)
Frontschweine (HKLM-x32\...\Hogs Of War) (Version: 1.0 - Infogrames)
Game Booster 3 (HKLM-x32\...\Game Booster_is1) (Version: 3.4 - IObit)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Heroes of Newerth (HKLM-x32\...\hon) (Version: 2.3.0 - S2 Games)
HijackThis 2.0.2 (HKLM-x32\...\HijackThis) (Version: 2.0.2 - TrendMicro)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.017 - HTC Corporation)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.5.0 - LIGHTNING UK!)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2119 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.01.01.1007 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
K-Lite Mega Codec Pack 7.5.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.5.0 - )
Lazarus 1.0.14 (HKLM\...\Lazarus_is1) (Version: 1.0.14 - Lazarus Team)
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Live Update 5 (HKLM-x32\...\{009E5DF2-3F97-480B-89DA-F2D5E672E14A}_is1) (Version: 5.0.086 - MSI)
Magicka (HKLM-x32\...\Steam App 42910) (Version:  - Arrowhead Game Studios AB)
MAGIX Foto Manager 9 (HKLM-x32\...\MAGIX Foto Manager 9 D) (Version: 7.0.3.118 - MAGIX AG)
MAGIX Music Maker 16 Download-Version (HKLM-x32\...\MAGIX Music Maker 16 Download-Version D) (Version: 16.0.3.0 - MAGIX AG)
MAGIX Online Druck Service (HKLM-x32\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
MAGIX Screenshare (HKLM-x32\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (HKLM-x32\...\MAGIX Speed burnR D) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Video easy SE (HKLM-x32\...\MAGIX_MSI_Video_easy_SE) (Version: 1.0.4.1 - MAGIX AG)
MAGIX Video easy SE (x32 Version: 1.0.4.1 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Virtual PC 2007 (HKLM\...\{8A7CAA24-7B23-410B-A7C3-F994B0944160}) (Version: 6.0.156.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM-x32\...\Microsoft Visual J# 2.0 Redistributable Package) (Version:  - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla)
msi Software Install (HKLM-x32\...\{A840FFFB-3A80-4C24-AB34-BE9F56BEB4CE}) (Version: 3.1000.1005.1101 - Micro-Star International Co., Ltd.)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.61.39 - NVIDIA Corporation)
NVIDIA Updatus (x32 Version: 1.0.3 - NVIDIA Corporation) Hidden
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
PDF24 Creator 5.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Project64 1.6 (HKLM-x32\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.50.1123.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7177 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.47 - Piriform)
Security Task Manager 1.8d (HKLM-x32\...\Security Task Manager) (Version: 1.8d - Neuber Software)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
System Control Manager (HKLM-x32\...\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}) (Version: 2.210.0604.006.19 - Micro-Star International Co., Ltd.)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
THX TruStudio Pro (HKLM-x32\...\{4FA6CB9A-2972-4AAF-A36E-3C40FCC22395}) (Version: 1.0 - Creative Technology Limited)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Access 2007 Help (KB963663) (HKLM-x32\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM-x32\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878234) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{EC1934B0-AE0F-4BBD-8955-54BB3247ED9E}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM-x32\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
VLC media player 1.1.10 (HKLM-x32\...\VLC media player) (Version: 1.1.10 - VideoLAN)
Vodafone Mobile Connect Lite (HKLM-x32\...\{79A64F98-1796-4FA2-B5FF-C90F83D8BACD}) (Version: 9.4.3.17550 - Vodafone)
Warcraft III (HKLM-x32\...\Warcraft III) (Version:  - )
Warcraft III: All Products (HKCU\...\Warcraft III) (Version:  - )
Windows Driver Package - ENE (EUCR) USB  (12/04/2009 5.89.0.64) (HKLM\...\7F973C87231D745EBF31E772CC38BB9B185D3819) (Version: 12/04/2009 5.89.0.64 - ENE)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR Archivierer (HKLM-x32\...\WinRAR archiver) (Version:  - )

==================== Restore Points  =========================

21-03-2014 15:05:49 Geplanter Prüfpunkt
25-03-2014 14:25:09 Windows Update
28-03-2014 21:07:20 Entfernt Grand Theft Auto IV
28-03-2014 21:24:04 Driver Booster : Realtek High Definition Audio

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0C937D9C-B55A-4F46-882F-D18AEC48B3C5} - System32\Tasks\{4D20FEBE-7B64-42EB-A38B-CCEFCED4A12B} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\GTAIV.exe
Task: {0C9AEB1E-16ED-4C12-8E80-CE61D37D4ADC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-15] (Google Inc.)
Task: {0FA2AC95-3052-48C1-BD9E-1D926F65CEB7} - \Advanced System Protector_startup No Task File
Task: {1053DE99-B96B-4E55-9973-D91276DA9200} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe [2013-06-08] ()
Task: {184DFE67-7F15-4016-8D8D-3C31A3A939A3} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {2B592459-9C89-4015-99E2-28607CFEAA46} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-15] (Google Inc.)
Task: {30524DFE-CC3B-4630-BEA7-DE2AF990D9B7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd)
Task: {5171809C-49CF-40E1-8ED9-C8EC776FED1F} - System32\Tasks\{D47C87E2-8E64-4554-B0CF-409E28EFF2D5} => C:\Program Files\Warcraft III - The Frozen Throne\Frozen Throne.exe [2011-10-14] (Blizzard Entertainment)
Task: {642D664F-203D-47C6-B737-717D079DDD0F} - System32\Tasks\{09A7A58D-6EC0-456A-9842-9126F4CDF113} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {7EAF7DFA-5B66-49F4-BAF9-7E4478E3448F} - System32\Tasks\{1594EC0A-8562-4CCE-8095-C78E9F1B347A} => D:\Spiele\Hon\hon.exe
Task: {88EECD71-56B9-435C-A171-6AE968C2E0DD} - System32\Tasks\{63E02A09-1CE0-4F61-A31D-8A5D8B1ACD2D} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\GTAIV.exe
Task: {903E1CA5-F1E9-4326-94CB-E7CF4D5DB142} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2014-03-13] (IObit)
Task: {9B42A12F-838D-4683-92DF-3B768E908CE1} - System32\Tasks\Driver Booster SkipUAC (Christoph) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2014-03-14] (IObit)
Task: {A367E982-7A27-4038-B0D9-2E46E30E5E6F} - System32\Tasks\{A1A601F3-E634-4532-B50E-9A8F9601B99E} => H:\BA\x-force_2012_x32.exe
Task: {A41E164C-C4C2-434D-8131-4113B04A8DDA} - System32\Tasks\{ECA4F254-C8A8-4717-9D37-41535AF9EBF0} => D:\Spiele\Warcraft III\Warcraft III.exe [2012-02-09] (Blizzard Entertainment)
Task: {AF5EDA2F-C674-49E9-A89F-454B2DE1EF4F} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2014-03-12] (IObit)
Task: {BCB4A359-E57E-41DB-AB78-1F6A854C7E4E} - System32\Tasks\{D5E017F6-41C2-4D64-A179-4E90AA669350} => C:\Program Files\Warcraft III - The Frozen Throne\Frozen Throne.exe [2011-10-14] (Blizzard Entertainment)
Task: {C0A676BA-9990-4200-A645-D8BBE52D6710} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {CCAA5D0C-25A7-4F7C-86B2-12CD77EF6266} - System32\Tasks\{13032228-ECB2-4550-9135-76492A834BF9} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {DE9D3300-FCA8-41D6-8D47-6BAA0DB10A93} - System32\Tasks\{14FA9FAE-BF70-44CF-A768-CD1C10E9522E} => C:\Downloads\8d8ce668232d8ebd0504b8c50173d2b9\Autodesk_AutoCAD_Mechanical_2008_GERMAN\Setup.exe
Task: {E533BD16-36EF-4BC1-8817-E831A3A1695C} - System32\Tasks\{93A4A4FD-3D24-44C5-9B86-EBE0AB938EE5} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\GTAIV.exe
Task: {EC0CDCFD-94B9-4E88-A9DC-CFAF6F610EA3} - \Advanced System Protector No Task File
Task: {EF3BE207-96C6-4E20-86BA-121FFBE5103B} - System32\Tasks\{573C9DF8-BEE4-460F-8CBA-475185D0D5A9} => D:\Spiele\Hon\hon.exe
Task: {F03B05D3-1AE3-4EE0-9CEB-8F0D1320D59B} - System32\Tasks\{7D7AC882-3D7D-45F8-A3FB-6F5C3E07AE87} => D:\Spiele\Hon\hon.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2005-06-07 10:26 - 2005-06-07 10:26 - 00043008 _____ () C:\Program Files (x86)\WinRAR 3.61 Multi\rarext64.dll
2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-02-25 14:52 - 2012-07-21 13:52 - 00076888 _____ () C:\windows\SysWOW64\PnkBstrA.exe
2013-12-24 18:32 - 2013-12-09 11:37 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2010-06-12 03:31 - 2010-05-17 20:56 - 00155648 _____ () C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\de-DE\THXAudio.resources.dll
2010-06-12 03:31 - 2010-05-04 18:59 - 00182272 _____ () C:\windows\SysWOW64\APOMngr.DLL
2014-02-13 15:28 - 2014-02-13 15:28 - 00170496 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\29335dc88d799664dcd97362bcb687e9\IsdiInterop.ni.dll
2010-06-12 03:14 - 2010-04-13 17:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
2014-03-15 12:52 - 2014-03-15 01:50 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:F63A059B

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: Autodesk Content Service => 2
MSCONFIG\Services: FirebirdServerMAGIXInstance => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Christoph^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^tbhcn.lnk => C:\windows\pss\tbhcn.lnk.Startup
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: ESL Wire => "C:\Program Files\EslWire\wire.exe" --tray
MSCONFIG\startupreg: iLivid => "C:\Users\Christoph\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: Live Update 5 => C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe /reminder
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/28/2014 10:48:36 PM) (Source: Microsoft-Windows-User Profiles Service) (User: VIET)
Description: Das lokale Benutzerprofil wurde nicht gefunden. Sie werden mit einem temporären Benutzerprofil angemeldet. Änderungen, die Sie am Benutzerprofil vornehmen, gehen bei der Abmeldung verloren.

Error: (03/28/2014 10:48:36 PM) (Source: Microsoft-Windows-User Profiles Service) (User: VIET)
Description: Dieses Benutzerprofil wurde gesichert. Bei der nächsten Anmeldung dieses Benutzers wird automatisch versucht, dieses gesicherte Profil zu verwenden.

Error: (03/28/2014 10:24:04 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2959067068-3289698165-731088358-1000.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {f2de33cb-1e70-4264-8c5d-83b5294e7416}

Error: (03/28/2014 10:07:21 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-2959067068-3289698165-731088358-1000.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {74b519ca-4371-4e26-8063-c0582720a7c8}

Error: (03/28/2014 05:05:14 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall

Error: (03/28/2014 02:15:20 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (03/28/2014 02:11:15 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (03/28/2014 01:14:19 PM) (Source: Microsoft-Windows-User Profiles Service) (User: VIET)
Description: Das lokale Benutzerprofil wurde nicht gefunden. Sie werden mit einem temporären Benutzerprofil angemeldet. Änderungen, die Sie am Benutzerprofil vornehmen, gehen bei der Abmeldung verloren.

Error: (03/28/2014 01:14:19 PM) (Source: Microsoft-Windows-User Profiles Service) (User: VIET)
Description: Dieses Benutzerprofil wurde gesichert. Bei der nächsten Anmeldung dieses Benutzers wird automatisch versucht, dieses gesicherte Profil zu verwenden.

Error: (03/27/2014 11:45:53 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall


System errors:
=============
Error: (03/28/2014 10:48:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "MBAMScheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/28/2014 10:48:00 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMScheduler erreicht.

Error: (03/24/2014 01:04:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet: 
%%1115

Error: (03/24/2014 11:38:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/24/2014 11:38:23 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (03/22/2014 06:11:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2014 06:11:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (03/22/2014 02:10:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/22/2014 02:09:53 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (03/21/2014 03:14:55 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2011-11-15 09:19:36.752
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:19:36.689
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:06:52.439
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:06:52.402
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:06:23.735
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:06:23.689
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:01:41.331
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:01:41.300
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:01:02.679
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-11-15 09:01:02.633
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ewusbmdm.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3885.5 MB
Available physical RAM: 2006.13 MB
Total Pagefile: 7769.19 MB
Available Pagefile: 5447.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS_Install) (Fixed) (Total:172.79 GB) (Free:24.73 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:113.2 GB) (Free:27.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 51EA6FCD)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=173 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=113 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 05:24 on 29/03/2014 (Christoph)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-29 06:40:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\fgtdypob.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075561465 2 bytes [56, 75]
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\windows\SysWOW64\svchost.exe[1876] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                    0000000075561465 2 bytes [56, 75]
.text  C:\windows\SysWOW64\svchost.exe[1876] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                   00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                         0000000075561465 2 bytes [56, 75]
.text  C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                        00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe[2540] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                         0000000075561465 2 bytes [56, 75]
.text  C:\Users\Christoph\AppData\Local\Akamai\netsession_win.exe[2540] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                        00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2776] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69    0000000075561465 2 bytes [56, 75]
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2776] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155   00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[2856] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69       0000000075561465 2 bytes [56, 75]
.text  C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[2856] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155      00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                          0000000073421a22 2 bytes [42, 73]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                          0000000073421ad0 2 bytes [42, 73]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                          0000000073421b08 2 bytes [42, 73]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                          0000000073421bba 2 bytes [42, 73]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                          0000000073421bda 2 bytes [42, 73]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                   0000000075561465 2 bytes [56, 75]
.text  C:\windows\SysWOW64\PnkBstrA.exe[2308] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                  00000000755614bb 2 bytes [56, 75]
.text  ...                                                                                                                                              * 2

---- EOF - GMER 2.1 ----
         

Exportierte Ereignisse:

27/02/2014 18:30 [System-Scanner] Malware gefunden
      Die Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      enthielt einen Virus oder unerwünschtes Programm 'Adware/AdLoad.C' [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55bde90a.qua' 
      verschoben!

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff verweigern

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben

27/02/2014 18:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 
      'C:\ProgramData\InstallMate\{3018F132-35D2-401E-A2F5-7DF0EBFBD3C4}\Custom.dll'
      wurde ein Virus oder unerwünschtes Programm 'ADWARE/AdLoad.C' [adware] gefunden.
      Ausgeführte Aktion: Zugriff erlauben
         

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.03.12.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16521
Christoph :: VIET [Administrator]

28/03/2014 23:38:08
mbam-log-2014-03-28 (23-38-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 598115
Laufzeit: 2 Stunde(n), 18 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)