| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win7 - PC laggt, komischer neuer Kontakt in SkypeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
30.03.2014, 14:31
| #1 |
 |  Win7 - PC laggt, komischer neuer Kontakt in Skype Hi Leute, Poste hier, weil mein PC seit heute gefühlt irgendwie langsamer läuft, ohne dass ich bewusst irgendetwas verändert, installiert o.ä. gemacht hätte. Habe dann gesehen, dass ich in Skype einen neuen Kontakt habe, den ich DEFINITIV weder hinzugefügt noch bestätigt habe. Normalerweise ist es ja nicht möglich das jemand einfach so in meiner Kontaktliste zu erscheinen. Habe den Kontakt dann direkt gelöscht. Hatte meinen Skype Accountnamen vor kurzem in einem öffentlich zugänglichen Forum gepostet (wo auch schon viele viele Scams passiert sind), ich habe die Vermutung das kommt irgendwie aus der Richtung. Habe jetzt etwas Angst, da ich von diesem Rechner aus viele Online-Zahlungsdienste und eWallets nutze. Hier die Logs: FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Jonas (administrator) on JONAS-PC on 30-03-2014 14:42:32
Running from C:\Users\Jonas\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe
(Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\ifxtcs.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Users\Jonas\AppData\Roaming\Mikogo 4\M4-Service.exe
(Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\IfxPsdSv.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
() C:\Program Files (x86)\Hotkey\PowerBiosServer.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
() C:\Users\Jonas\AppData\Roaming\Mikogo 4\M4-Capture.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Chicony) C:\Program Files (x86)\ChiconyCam\CECAPLF.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Jonas\AppData\Roaming\Spotify\spotify.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Flux Software LLC) C:\Users\Jonas\AppData\Local\FluxSoftware\Flux\flux.exe
() C:\Program Files (x86)\Free Desktop Timer\DesktopTimer.exe
() C:\Program Files (x86)\Hotkey\Hotkey.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\PSDrt.exe
(Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\SpTna.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
() C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2328360 2010-09-16] (Synaptics Incorporated)
HKLM\...\Run: [CECAPLF] - C:\Program Files (x86)\ChiconyCam\CECAPLF.exe [121456 2011-07-06] (Chicony)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5119600 2012-05-10] (VIA)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [IFXSPMGT] - C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe [1160480 2010-02-23] (Infineon Technologies AG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2092032 2014-02-03] (Dominik Reichl)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160 2014-02-13] (APN)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [Spotify Web Helper] - C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [Spotify] - C:\Users\Jonas\AppData\Roaming\Spotify\spotify.exe [6118400 2014-01-13] (Spotify Ltd)
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [21822128 2014-01-30] (Google)
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [f.lux] - C:\Users\Jonas\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [FreeDesktopTimer] - C:\Program Files (x86)\Free Desktop Timer\DesktopTimer.exe [623616 2013-01-26] ()
HKU\S-1-5-21-987023994-4017990490-3391408888-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysn.de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mysn.de
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {2F8D2B09-4EB2-4D33-889C-A1FA5860927B} URL =
SearchScopes: HKCU - {2F8D2B09-4EB2-4D33-889C-A1FA5860927B} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1382282165536
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default
FF DefaultSearchEngine: webwebweb
FF SelectedSearchEngine: webwebweb
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Garmin Communicator - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-19]
FF Extension: Video Downloader professional - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default\Extensions\ffext_basicvideoext@startpage24.xpi [2013-10-08]
FF Extension: Dict.cc Translation - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default\Extensions\searchdictcc@roughael.xpi [2013-10-08]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-10-23]
FF Extension: Adblock Plus - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ictpycy8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-08]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 IFXSpMgtSrv; C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe [1160480 2010-02-23] (Infineon Technologies AG)
R2 IFXTCS; C:\Program Files (x86)\Infineon\Security Platform Software\ifxtcs.exe [992544 2010-02-23] (Infineon Technologies AG)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
R2 M4-Service; C:\Users\Jonas\AppData\Roaming\Mikogo 4\M4-Service.exe [1008968 2013-04-10] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 PersonalSecureDriveService; C:\Program Files (x86)\Infineon\Security Platform Software\IfxPsdSv.exe [214304 2010-02-23] (Infineon Technologies AG)
R2 PowerBiosServer; C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [35328 2011-02-18] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-03] (VIA Technologies, Inc.)
R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2010-01-25] (Infineon Technologies AG)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-30 14:42 - 2014-03-30 14:42 - 00017124 _____ () C:\Users\Jonas\Desktop\FRST.txt
2014-03-30 14:42 - 2014-03-30 14:42 - 00000000 ____D () C:\FRST
2014-03-30 14:41 - 2014-03-30 14:41 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log
2014-03-30 14:41 - 2014-03-30 14:41 - 00000000 _____ () C:\Users\Jonas\defogger_reenable
2014-03-30 14:40 - 2014-03-30 14:41 - 02157056 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe
2014-03-30 14:39 - 2014-03-30 14:39 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe
2014-03-29 22:38 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-03-29 22:38 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-28 17:16 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-28 17:16 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-28 17:16 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-28 17:16 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-28 17:16 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-28 17:16 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-28 17:16 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-28 17:16 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-28 17:16 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-03-28 17:16 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-03-28 17:16 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-28 17:16 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-28 17:16 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-03-28 17:16 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-28 17:16 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-03-28 17:16 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-03-28 17:13 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-03-28 17:13 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-03-17 19:08 - 2014-03-28 03:58 - 00000000 ____D () C:\Users\Jonas\Documents\LuckyAcePoker
2014-03-17 19:08 - 2014-03-17 19:08 - 00002106 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\LuckyAcePoker.com.lnk
2014-03-17 19:08 - 2014-03-17 19:08 - 00002082 _____ () C:\Users\postgres\Desktop\LuckyAcePoker.com.lnk
2014-03-17 19:08 - 2014-03-17 19:08 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LuckyAcePoker.com
2014-03-17 19:07 - 2014-03-17 19:18 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\LuckyAcePoker.com
2014-03-17 19:07 - 2014-03-17 19:08 - 00000000 ____D () C:\Program Files (x86)\LuckyAcePoker.com
2014-03-17 15:55 - 2014-03-17 15:55 - 00000760 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Coral Poker.lnk
2014-03-17 15:42 - 2014-03-17 15:42 - 00210232 _____ (Playtech) C:\Users\Jonas\Downloads\PokerSetup_8e0fd0.exe
2014-03-17 13:27 - 2014-03-17 13:27 - 00000809 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\William Hill Poker.lnk
2014-03-15 15:06 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-15 15:06 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-15 15:06 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-15 15:06 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-15 15:06 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-15 15:06 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-15 15:06 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-15 15:06 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-15 15:06 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-15 15:06 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-15 15:06 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-15 15:06 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-15 15:06 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-15 15:06 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-15 15:06 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-15 15:06 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-15 15:06 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-15 15:06 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-15 15:06 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-15 15:06 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-15 15:06 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-15 15:06 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-15 15:06 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-15 15:06 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-15 15:06 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-15 15:06 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-15 15:06 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-15 15:06 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-15 15:06 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-15 15:06 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-15 15:06 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-15 15:06 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-15 15:06 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-15 15:06 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-15 15:06 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-15 15:06 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-15 15:06 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-15 15:06 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-15 15:06 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-15 15:06 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-15 13:09 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-15 13:09 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-15 13:09 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-15 13:09 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-15 13:09 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-15 13:08 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-15 13:08 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-15 13:08 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 19:45 - 2014-03-14 19:45 - 00000000 ____D () C:\Users\Jonas\Documents\Anki
2014-03-14 19:44 - 2014-03-14 19:44 - 00000742 _____ () C:\Users\postgres\Desktop\Anki.lnk
2014-03-14 19:44 - 2014-03-14 19:44 - 00000000 ____D () C:\Program Files (x86)\Anki
2014-03-11 02:52 - 2014-03-11 03:41 - 00000000 ____D () C:\Users\Jonas\Documents\888poker
2014-03-11 02:52 - 2014-03-11 02:52 - 00002010 _____ () C:\Users\postgres\Desktop\888poker.lnk
2014-03-11 02:52 - 2014-03-11 02:52 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2014-03-11 02:51 - 2014-03-17 19:07 - 00000000 ____D () C:\Program Files (x86)\PacificPoker
2014-03-11 02:51 - 2014-03-11 02:52 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\PacificPoker
2014-03-10 10:36 - 2014-03-30 13:03 - 00001680 _____ () C:\Windows\setupact.log
2014-03-10 10:36 - 2014-03-10 10:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-05 09:16 - 2014-03-05 09:16 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-05 09:16 - 2014-03-05 09:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-05 09:16 - 2014-03-05 09:16 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Skype
2014-03-03 13:11 - 2014-03-28 17:06 - 00000000 ____D () C:\Users\Jonas\Desktop\Fertigungstechnik Bergmann
2014-02-28 17:29 - 2014-03-15 02:12 - 00000408 _____ () C:\Users\Jonas\AppData\Roaming\CamShapes.ini
2014-02-28 17:29 - 2014-03-15 02:12 - 00000408 _____ () C:\Users\Jonas\AppData\Roaming\CamLayout.ini
2014-02-28 17:29 - 2014-03-15 02:12 - 00000125 _____ () C:\Users\Jonas\AppData\Roaming\Camdata.ini
2014-02-28 16:04 - 2014-03-07 15:17 - 00004543 _____ () C:\Users\Jonas\AppData\Roaming\CamStudio.cfg
2014-02-28 15:26 - 2014-03-14 20:59 - 00000000 ____D () C:\Users\Jonas\Documents\My CamStudio Temp Files
2014-02-28 15:25 - 2014-03-14 20:42 - 00000096 _____ () C:\Users\Jonas\AppData\Roaming\version2.xml
2014-02-28 15:24 - 2014-02-28 15:24 - 00000000 ____D () C:\Program Files\CamStudio 2.7
==================== One Month Modified Files and Folders =======
2014-03-30 14:42 - 2014-03-30 14:42 - 00017124 _____ () C:\Users\Jonas\Desktop\FRST.txt
2014-03-30 14:42 - 2014-03-30 14:42 - 00000000 ____D () C:\FRST
2014-03-30 14:41 - 2014-03-30 14:41 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log
2014-03-30 14:41 - 2014-03-30 14:41 - 00000000 _____ () C:\Users\Jonas\defogger_reenable
2014-03-30 14:41 - 2014-03-30 14:40 - 02157056 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe
2014-03-30 14:41 - 2013-10-08 15:24 - 00000000 ____D () C:\Users\Jonas
2014-03-30 14:39 - 2014-03-30 14:39 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe
2014-03-30 14:39 - 2013-12-02 11:45 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-30 14:35 - 2013-10-08 16:19 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Skype
2014-03-30 14:08 - 2013-10-09 03:34 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\vlc
2014-03-30 14:04 - 2013-12-26 01:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-30 13:48 - 2013-10-13 19:46 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Spotify
2014-03-30 13:43 - 2013-10-07 20:59 - 01421262 _____ () C:\Windows\WindowsUpdate.log
2014-03-30 13:13 - 2010-11-21 08:50 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-03-30 13:13 - 2010-11-21 08:50 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-03-30 13:13 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-30 13:11 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-30 13:11 - 2009-07-14 06:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-30 13:06 - 2013-10-08 15:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 13:06 - 2013-10-08 15:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-30 13:04 - 2013-12-02 12:02 - 00000000 ___RD () C:\Users\Jonas\Google Drive
2014-03-30 13:03 - 2014-03-10 10:36 - 00001680 _____ () C:\Windows\setupact.log
2014-03-30 13:03 - 2013-12-02 11:45 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-30 13:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-30 07:01 - 2013-10-09 13:26 - 00000000 ____D () C:\Users\postgres
2014-03-30 00:20 - 2013-10-08 19:05 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\KeePass
2014-03-29 18:11 - 2013-10-08 16:09 - 00000000 ____D () C:\Program Files (x86)\PokerTracker 4
2014-03-29 08:33 - 2013-10-08 16:12 - 00000000 ____D () C:\Users\Jonas\AppData\Local\PokerStars.EU
2014-03-28 17:16 - 2013-10-07 21:05 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-28 17:06 - 2014-03-03 13:11 - 00000000 ____D () C:\Users\Jonas\Desktop\Fertigungstechnik Bergmann
2014-03-28 13:24 - 2013-10-20 17:08 - 00000000 ____D () C:\Users\Jonas\AppData\Local\FreePDF_XP
2014-03-28 03:58 - 2014-03-17 19:08 - 00000000 ____D () C:\Users\Jonas\Documents\LuckyAcePoker
2014-03-27 16:34 - 2013-12-02 11:45 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-27 16:34 - 2013-12-02 11:45 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-26 18:52 - 2013-10-09 20:19 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Equilab
2014-03-24 13:00 - 2013-10-13 19:46 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Spotify
2014-03-23 13:04 - 2013-10-08 16:17 - 00000000 ____D () C:\Program Files (x86)\TableNinja
2014-03-17 19:18 - 2014-03-17 19:07 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\LuckyAcePoker.com
2014-03-17 19:09 - 2013-10-08 16:57 - 00000000 ____D () C:\Users\Jonas\Desktop\Progs
2014-03-17 19:08 - 2014-03-17 19:08 - 00002106 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\LuckyAcePoker.com.lnk
2014-03-17 19:08 - 2014-03-17 19:08 - 00002082 _____ () C:\Users\postgres\Desktop\LuckyAcePoker.com.lnk
2014-03-17 19:08 - 2014-03-17 19:08 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LuckyAcePoker.com
2014-03-17 19:08 - 2014-03-17 19:07 - 00000000 ____D () C:\Program Files (x86)\LuckyAcePoker.com
2014-03-17 19:07 - 2014-03-11 02:51 - 00000000 ____D () C:\Program Files (x86)\PacificPoker
2014-03-17 15:55 - 2014-03-17 15:55 - 00000760 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Coral Poker.lnk
2014-03-17 15:55 - 2013-10-08 16:07 - 00000000 ____D () C:\Poker
2014-03-17 15:42 - 2014-03-17 15:42 - 00210232 _____ (Playtech) C:\Users\Jonas\Downloads\PokerSetup_8e0fd0.exe
2014-03-17 13:27 - 2014-03-17 13:27 - 00000809 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\William Hill Poker.lnk
2014-03-16 20:52 - 2014-02-27 09:26 - 00000000 ____D () C:\Users\Jonas\Desktop\Neuer Ordner
2014-03-15 15:54 - 2014-01-22 01:21 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-15 15:54 - 2014-01-22 01:21 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-15 15:07 - 2013-10-08 23:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-15 14:26 - 2009-07-14 06:45 - 00344080 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-15 13:27 - 2013-10-08 19:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-15 13:26 - 2013-10-08 19:31 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-15 02:12 - 2014-02-28 17:29 - 00000408 _____ () C:\Users\Jonas\AppData\Roaming\CamShapes.ini
2014-03-15 02:12 - 2014-02-28 17:29 - 00000408 _____ () C:\Users\Jonas\AppData\Roaming\CamLayout.ini
2014-03-15 02:12 - 2014-02-28 17:29 - 00000125 _____ () C:\Users\Jonas\AppData\Roaming\Camdata.ini
2014-03-14 20:59 - 2014-02-28 15:26 - 00000000 ____D () C:\Users\Jonas\Documents\My CamStudio Temp Files
2014-03-14 20:42 - 2014-02-28 15:25 - 00000096 _____ () C:\Users\Jonas\AppData\Roaming\version2.xml
2014-03-14 19:45 - 2014-03-14 19:45 - 00000000 ____D () C:\Users\Jonas\Documents\Anki
2014-03-14 19:44 - 2014-03-14 19:44 - 00000742 _____ () C:\Users\postgres\Desktop\Anki.lnk
2014-03-14 19:44 - 2014-03-14 19:44 - 00000000 ____D () C:\Program Files (x86)\Anki
2014-03-12 00:09 - 2013-12-26 01:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 00:09 - 2013-10-08 17:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 00:09 - 2013-10-08 17:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 11:44 - 2013-10-08 16:11 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Mikogo 4
2014-03-11 03:41 - 2014-03-11 02:52 - 00000000 ____D () C:\Users\Jonas\Documents\888poker
2014-03-11 02:52 - 2014-03-11 02:52 - 00002010 _____ () C:\Users\postgres\Desktop\888poker.lnk
2014-03-11 02:52 - 2014-03-11 02:52 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2014-03-11 02:52 - 2014-03-11 02:51 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\PacificPoker
2014-03-10 10:36 - 2014-03-10 10:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-09 17:08 - 2013-12-25 11:28 - 00025600 ___SH () C:\Users\Jonas\Thumbs.db
2014-03-07 15:17 - 2014-02-28 16:04 - 00004543 _____ () C:\Users\Jonas\AppData\Roaming\CamStudio.cfg
2014-03-06 10:28 - 2013-10-08 16:17 - 00002989 _____ () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TableNinja.lnk
2014-03-05 09:16 - 2014-03-05 09:16 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-05 09:16 - 2014-03-05 09:16 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-05 09:16 - 2014-03-05 09:16 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Skype
2014-03-05 09:16 - 2013-10-08 16:19 - 00000000 ____D () C:\ProgramData\Skype
2014-03-03 11:09 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-02 18:15 - 2014-01-09 22:29 - 00000000 ____D () C:\Users\Jonas\Documents\Camtasia Studio
2014-03-01 08:05 - 2014-03-15 15:06 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 07:17 - 2014-03-15 15:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 07:16 - 2014-03-15 15:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 06:58 - 2014-03-15 15:06 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 06:52 - 2014-03-15 15:06 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 06:51 - 2014-03-15 15:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 06:42 - 2014-03-15 15:06 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 06:40 - 2014-03-15 15:06 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 06:37 - 2014-03-15 15:06 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 06:33 - 2014-03-15 15:06 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 06:33 - 2014-03-15 15:06 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 06:32 - 2014-03-15 15:06 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 06:30 - 2014-03-15 15:06 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 06:23 - 2014-03-15 15:06 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 06:17 - 2014-03-15 15:06 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 06:11 - 2014-03-15 15:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 06:02 - 2014-03-15 15:06 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 05:54 - 2014-03-15 15:06 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 05:52 - 2014-03-15 15:06 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 05:51 - 2014-03-15 15:06 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 05:47 - 2014-03-15 15:06 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 05:43 - 2014-03-15 15:06 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 05:43 - 2014-03-15 15:06 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 05:42 - 2014-03-15 15:06 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 05:40 - 2014-03-15 15:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 05:38 - 2014-03-15 15:06 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 05:37 - 2014-03-15 15:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 05:35 - 2014-03-15 15:06 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 05:18 - 2014-03-15 15:06 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 05:16 - 2014-03-15 15:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 05:14 - 2014-03-15 15:06 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 05:10 - 2014-03-15 15:06 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 05:03 - 2014-03-15 15:06 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 05:00 - 2014-03-15 15:06 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 04:57 - 2014-03-15 15:06 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 04:38 - 2014-03-15 15:06 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 04:32 - 2014-03-15 15:06 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 04:27 - 2014-03-15 15:06 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 04:25 - 2014-03-15 15:06 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-01 04:25 - 2014-03-15 15:06 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-28 15:24 - 2014-02-28 15:24 - 00000000 ____D () C:\Program Files\CamStudio 2.7
2014-02-28 10:47 - 2013-10-08 16:06 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
Files to move or delete:
====================
C:\Users\Jonas\AppData\Roaming\CamLayout.ini
C:\Users\Jonas\AppData\Roaming\CamShapes.ini
Some content of TEMP:
====================
C:\Users\Jonas\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-20 14:26
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Jonas at 2014-03-30 14:42:50
Running from C:\Users\Jonas\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
888poker (HKLM-x32\...\888poker) (Version: - )
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Anki (HKLM-x32\...\Anki) (Version: - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
Betfair.com Poker (HKCU\...\Betfair.com Poker) (Version: - )
BisonCam (HKLM-x32\...\{5BBC4803-C96E-4D3E-9D1D-2E43774C4062}) (Version: - BisonCam)
CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
ChiconyCam (HKLM-x32\...\{A2201542-DA80-457F-8BD9-6C9C90196481}) (Version: 1.0.54.0521 - Chicony Electronics Co.,Ltd.)
Coral Poker (HKCU\...\Coral Poker) (Version: - )
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{DC4BC0CC-A928-4C48-BA40-AC24784F46E5}) (Version: - Microsoft)
f.lux (HKCU\...\Flux) (Version: - )
Free Desktop Timer 1.2 (HKLM-x32\...\Free Desktop Timer_is1) (Version: - Drive Software Company)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 4.65.2.WIN.FullTilt.EU - )
Google Drive (HKLM-x32\...\{E87022D3-C8C9-4C76-8E27-BC7F18F9B8FB}) (Version: 1.14.6059.644 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{D4C4A751-F7F3-4DCA-B825-9AC391BFFC3F}) (Version: 1.0.19.76 - Google)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
HHLoader (HKCU\...\HHLoader) (Version: - )
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version: - )
Hotkey 6.0046 (HKLM-x32\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 6.0046 - NoteBook)
Hotkey 6.0046 (x32 Version: 6.0046 - NoteBook) Hidden
ICM Trainer Light (HKLM-x32\...\{3C630BB8-692D-4495-A0BD-40336CD51F99}) (Version: 1.4 - PokerStrategy.com)
Infineon TPM Professional Package (HKLM\...\{127D5F95-D83A-40FC-AB4E-109A0B33F296}) (Version: 3.7.000 - Infineon Technologies AG)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.12.1498 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
KeePass Password Safe 2.25 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.25 - Dominik Reichl)
LuckyAcePoker.com (HKLM-x32\...\LuckyAcePoker.com) (Version: - )
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mikogo 4 (HKCU\...\Mikogo 4) (Version: 4.7 - BeamYourScreen GmbH)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
partypoker (HKLM-x32\...\PartyPoker) (Version: - PartyGaming)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Poker 770 (HKCU\...\Poker 770) (Version: - )
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
PokerStars.fr (HKLM-x32\...\PokerStars.fr) (Version: - PokerStars.fr)
PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version: - )
PostgreSQL 9.0 (HKLM\...\PostgreSQL 9.0) (Version: 9.0 - PostgreSQL Global Development Group)
Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.27020 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.7.16.g4b197456 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.14.0 - Synaptics Incorporated)
TableNinja (HKLM-x32\...\{1539AE35-19D3-4857-A320-16DC48C16B3B}) (Version: 1.2.159 - ALXSoftware)
TableScan Turbo v1.0.10 (HKLM-x32\...\{0B82D6C6-9ECC-4710-97AB-5CE482E72852}_is1) (Version: - Zandry, LLC)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.22298 - TeamViewer)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{99A0DB9A-71FC-4F98-BC1F-78A18195C677}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{DB0B0CDF-77EC-47B0-94E2-4738573A1E58}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{1AA82E2E-7DB7-4C70-910C-BBB657A6B3A5}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{EBD18DE5-BC84-4B57-9A30-097044871F9A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{64D96F30-CF4C-4CCE-AAF2-F8909348BF35}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUSR_{9F6507AC-7D8F-46C1-B90F-59C7828E0E0D}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 64-Bit Edition (HKLM\...\{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{A9C4BE58-07E0-473D-AE68-ECBA13FBF77E}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{6164E0E5-C903-488C-93AF-1B7AF7EBC331}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{DDDC32A5-9528-4771-B91A-97A8E1D7957B}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (HKLM\...\{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{BEA3259E-14B5-4D89-87FF-ED9F1D0D81C8}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{BE1D254A-E5CD-4E76-9BE8-7B2E5FDBA6AF}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{04DED3FB-DDB2-4C1E-A057-2A1FB97BE42D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{DF33B92A-5381-4F03-AB54-2D67086B357E}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{A82E26EF-680E-427D-B7D0-FD7997DDC217}) (Version: - Microsoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebCam Installer (x32 Version: 4.041 - WebCam) Hidden
William Hill Poker (HKCU\...\William Hill Poker) (Version: - )
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
xp-AntiSpy 3.98-2 (HKLM-x32\...\xp-AntiSpy) (Version: - Christian Taubenheim)
==================== Restore Points =========================
25-03-2014 09:58:32 Windows Update
28-03-2014 15:16:20 Windows Update
29-03-2014 20:38:56 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {2818747C-8560-4F98-81AD-41DE9B9DB807} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {3E652BE3-92C5-4356-9EDA-D5BBB7636A8E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {5176E56E-232A-43EC-B74D-F4F590B001D9} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-01-17] ()
Task: {67ADB2F9-9E0F-4FBC-907D-5BBFAA29AA11} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)
Task: {9E13EB62-2458-48F0-945B-7FC1297C47AC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)
Task: {C76980D1-0955-40FB-BE37-172811A4E671} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-10-08 16:28 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2013-04-10 15:46 - 2013-04-10 15:46 - 01008968 _____ () C:\Users\Jonas\AppData\Roaming\Mikogo 4\M4-Service.exe
2013-10-09 13:26 - 2012-09-21 09:55 - 00217600 _____ () C:\Program Files\PostgreSQL\9.0\bin\LIBPQ.dll
2011-02-18 15:57 - 2011-02-18 15:57 - 00035328 _____ () C:\Program Files (x86)\Hotkey\PowerBiosServer.exe
2013-10-09 13:26 - 2012-08-14 14:02 - 02258432 _____ () C:\Program Files\PostgreSQL\9.0\bin\libxml2.dll
2014-03-11 11:44 - 2014-03-11 11:44 - 01592632 _____ () C:\Users\Jonas\AppData\Roaming\Mikogo 4\M4-Capture.exe
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-27 11:55 - 2012-12-12 17:38 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-07 01:14 - 2013-01-26 12:52 - 00623616 _____ () C:\Program Files (x86)\Free Desktop Timer\DesktopTimer.exe
2012-04-13 11:35 - 2012-04-13 11:35 - 04727808 _____ () C:\Program Files (x86)\Hotkey\Hotkey.exe
2013-10-07 15:10 - 2012-05-10 03:46 - 00078448 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-10-07 15:10 - 2012-05-10 03:46 - 00386160 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-10-13 19:46 - 2014-01-13 21:38 - 00603648 _____ () C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2013-10-08 18:27 - 2013-09-30 11:01 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-10-13 19:46 - 2014-01-13 21:38 - 36967424 _____ () C:\Users\Jonas\AppData\Roaming\Spotify\Data\libcef.dll
2009-06-06 14:50 - 2009-06-06 14:50 - 00019968 _____ () C:\Program Files (x86)\Hotkey\Audiodll.dll
2014-03-30 13:03 - 2014-03-30 13:03 - 00098816 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32api.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00110080 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\pywintypes27.dll
2014-03-30 13:03 - 2014-03-30 13:03 - 00364544 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\pythoncom27.dll
2014-03-30 13:03 - 2014-03-30 13:03 - 00044032 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_socket.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 01157120 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_ssl.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00320512 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32com.shell.shell.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00712192 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_hashlib.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 01175040 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._core_.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00805888 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._gdi_.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00811008 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._windows_.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 01062400 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._controls_.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00735232 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._misc_.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00128512 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_elementtree.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00127488 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\pyexpat.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00557056 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\pysqlite2._sqlite.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00087040 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_ctypes.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00119808 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32file.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00108544 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32security.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00018432 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32event.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00038912 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32inet.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00122368 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._wizard.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00070656 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\wx._html2.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00026624 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\_multiprocessing.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00010240 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\select.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00024064 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32pipe.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00686080 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\unicodedata.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00025600 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32pdh.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00525640 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\windows._lib_cacheinvalidation.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00011264 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32crypt.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00035840 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32process.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00017408 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32profile.pyd
2014-03-30 13:03 - 2014-03-30 13:03 - 00022528 _____ () C:\Users\Jonas\AppData\Local\Temp\_MEI30842\win32ts.pyd
2013-10-13 19:46 - 2014-01-13 21:38 - 00887808 _____ () C:\Users\Jonas\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-10-13 19:46 - 2014-01-13 21:38 - 00109568 _____ () C:\Users\Jonas\AppData\Roaming\Spotify\Data\libegl.dll
2013-10-07 15:09 - 2012-05-10 09:03 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-02-22 05:23 - 2014-02-22 05:23 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\b162055347700182d96325676dd591c4\IsdiInterop.ni.dll
2013-10-07 15:10 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-10-08 15:31 - 2014-03-30 13:06 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-12 00:09 - 2014-03-12 00:09 - 16276872 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00313992 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/30/2014 01:03:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/30/2014 07:03:44 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/29/2014 05:53:37 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: googledrivesync.exe, Version: 1.14.6059.644, Zeitstempel: 0x509418e4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e3be
ID des fehlerhaften Prozesses: 0xfd4
Startzeit der fehlerhaften Anwendung: 0xgoogledrivesync.exe0
Pfad der fehlerhaften Anwendung: googledrivesync.exe1
Pfad des fehlerhaften Moduls: googledrivesync.exe2
Berichtskennung: googledrivesync.exe3
Error: (03/29/2014 07:53:01 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/29/2014 00:09:10 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/28/2014 04:15:20 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/28/2014 00:20:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/27/2014 11:10:00 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/26/2014 11:08:30 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/25/2014 10:33:34 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (03/30/2014 01:06:02 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc
Error: (03/30/2014 07:37:57 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (03/30/2014 07:04:26 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc
Error: (03/30/2014 00:20:26 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (03/30/2014 00:13:49 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (03/29/2014 07:55:33 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc
Error: (03/29/2014 00:43:45 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (03/29/2014 00:10:20 AM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc
Error: (03/28/2014 09:31:42 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (03/28/2014 04:15:49 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc
Microsoft Office Sessions:
=========================
Error: (03/30/2014 01:03:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/30/2014 07:03:44 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/29/2014 05:53:37 PM) (Source: Application Error)(User: )
Description: googledrivesync.exe1.14.6059.644509418e4ntdll.dll6.1.7601.18247521ea8e7c00000050002e3befd401cf4b132449f5baC:\Program Files (x86)\Google\Drive\googledrivesync.exeC:\Windows\SysWOW64\ntdll.dll49d84a1d-b75a-11e3-9c75-0090f5ec501b
Error: (03/29/2014 07:53:01 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/29/2014 00:09:10 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/28/2014 04:15:20 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/28/2014 00:20:21 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/27/2014 11:10:00 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/26/2014 11:08:30 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/25/2014 10:33:34 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 42%
Total physical RAM: 8067.55 MB
Available physical RAM: 4665.55 MB
Total Pagefile: 16133.29 MB
Available Pagefile: 10941.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:112.45 GB) (Free:31.26 GB) NTFS
Drive r: (Recovery) (Fixed) (Total:10.74 GB) (Free:6.42 GB) NTFS
Drive z: (Daten) (Fixed) (Total:109.35 GB) (Free:82.21 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 5CF408FB)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=109 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=11 GB) - (Type=27)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-30 15:26:47
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.EXT0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Jonas\AppData\Local\Temp\kwloypow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002dfc000 63 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff80002dfc040 1 byte [01]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe[1696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fd1465 2 bytes [FD, 76]
.text C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe[1696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fd14bb 2 bytes [FD, 76]
.text ... * 2
.text C:\Program Files (x86)\Hotkey\Hotkey.exe[3200] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076fd1465 2 bytes [FD, 76]
.text C:\Program Files (x86)\Hotkey\Hotkey.exe[3200] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076fd14bb 2 bytes [FD, 76]
.text ... * 2
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fd1465 2 bytes [FD, 76]
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fd14bb 2 bytes [FD, 76]
.text ... * 2
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[2604] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076fd1465 2 bytes [FD, 76]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[2604] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000076fd14bb 2 bytes [FD, 76]
.text ... * 2
.text C:\Program Files (x86)\Infineon\Security Platform Software\PSDrt.exe[5188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076fd1465 2 bytes [FD, 76]
.text C:\Program Files (x86)\Infineon\Security Platform Software\PSDrt.exe[5188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076fd14bb 2 bytes [FD, 76]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\681729ebcc5f
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\681729ebcc5f (not active ControlSet)
---- EOF - GMER 2.1 ----
Danke im Vorfeld für jegliche Hilfe! |
| Themen zu Win7 - PC laggt, komischer neuer Kontakt in Skype |
| adobe, antivir, antivirus, avira, browser, cpu, defender, device driver, downloader, excel, explorer, firefox, firefox 28.0, flash player, google, home, monitor, mozilla, ntdll.dll, registry, rundll, scan, security, services.exe, software, spotify web helper, svchost.exe, system, temp |
Baum-Darstellung