Windows 8.1 Lenovo Laptop und sein Eigenleben

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-04-2014 01
Ran by Manfred (administrator) on MANFRED2 on 25-04-2014 20:21:09
Running from C:\Users\Manfred\Downloads\scan
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
() C:\Megatech\MProtect\MPSERV.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel) C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\System32\alg.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(FileOpen Systems Inc.) C:\Program Files\FileOpen\Services\FileOpenManager64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Windows\SysWOW64\UMonit64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
() C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\ff.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891592 2013-05-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13545032 2013-05-28] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1308232 2013-05-20] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [UMonit64] => C:\WINDOWS\SysWOW64\UMonit64.exe [40960 2013-04-09] ()
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17097200 2013-12-01] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2013-12-01] (Lenovo(beijing) Limited)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1179576 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7818040 2013-09-19] (Motorola Solutions, Inc.)
HKLM\...\Run: [FileOpenBroker] => C:\Program Files\FileOpen\Services\FileOpenBroker64.exe [1589104 2013-03-26] (FileOpen Systems Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2012-09-25] ()
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-03-28] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-985481003-2855859536-316065226-1002\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-985481003-2855859536-316065226-1002\...\MountPoints2: {ee1ff127-a38a-11e3-be81-00c2c612f4ca} - "F:\setup.exe" 
AppInit_DLLs: C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [184048 2013-11-01] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [156256 2013-11-01] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM - DefaultScope {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKLM - {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKLM-x32 - DefaultScope {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKLM-x32 - {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKCU - DefaultScope {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = 
SearchScopes: HKCU - {35C504FE-189D-4414-8AF5-31CE364E16CB} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{B69759E6-13EA-4C03-B40A-0329E7B46251}: [NameServer]141.60.110.103,141.60.120.105

FireFox:
========
FF ProfilePath: C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: intel.com/AppUp - C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\staged [2014-04-25]
FF Extension: Flashblock - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-03-26]
FF Extension: WOT - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-29]
FF Extension: DownloadHelper - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26]
FF Extension: Exif Viewer - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\exif_viewer@mozilla.doslash.org.xpi [2014-03-29]
FF Extension: NoScript - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-23]
FF Extension: Adblock Plus - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\fuwi1mpa.default-1395530244016\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-03-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-03-28] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-03-28] (Avira Operations GmbH & Co. KG)
R2 BrcmSetSecurity; C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe [101536 2013-05-28] (Intel)
R2 FileOpenManager; C:\Program Files\FileOpen\Services\FileOpenManager64.exe [337264 2013-03-19] (FileOpen Systems Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-15] (Intel Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-15] (Intel Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-03-28] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-03-28] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2014-03-28] (Avira Operations GmbH & Co. KG)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
S2 CSDriver; C:\WINDOWS\SysWOW64\Drivers\CSDriver.Sys [6027 2002-09-24] (Windows (R) 2000 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-03-04] (Disc Soft Ltd)
R3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [22280 2013-05-16] (ELAN Microelectronic Corp.)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-03-01] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-08-22] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-03-01] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-14] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [206744 2013-05-28] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-25 20:21 - 2014-04-25 20:21 - 00000000 ____D () C:\FRST
2014-04-25 20:19 - 2014-04-25 20:19 - 00000168 _____ () C:\Users\Manfred\defogger_reenable
2014-04-25 20:16 - 2014-04-25 20:21 - 00000000 ____D () C:\Users\Manfred\Downloads\scan
2014-04-25 08:13 - 2014-04-25 10:51 - 00000000 ____D () C:\Users\Manfred\Desktop\Manfred HOJ2
2014-04-24 23:09 - 2014-04-24 23:09 - 00001290 _____ () C:\Users\Manfred\Desktop\Prüfung Meister - Verknüpfung.lnk
2014-04-24 16:53 - 2014-04-24 16:53 - 00000000 ____D () C:\Program Files\FileOpen
2014-04-24 16:53 - 2014-04-24 16:53 - 00000000 ____D () C:\Program Files (x86)\FileOpen
2014-04-23 15:15 - 2014-04-23 15:15 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-04-23 15:15 - 2014-04-23 15:15 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-23 15:05 - 2014-04-23 15:05 - 00003172 _____ () C:\WINDOWS\System32\Tasks\{95F2D096-A407-4C8E-A49B-B9B5F98E6F64}
2014-04-21 21:56 - 2014-04-21 21:56 - 00004224 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 21:56 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 21:56 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-04-21 21:56 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-04-21 21:56 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-04-21 21:39 - 2014-04-21 21:40 - 02707456 _____ () C:\Users\Manfred\Downloads\FileOpenInstaller64(2).msi
2014-04-21 21:34 - 2014-04-21 21:34 - 02707456 _____ () C:\Users\Manfred\Downloads\FileOpenInstaller64(1).msi
2014-04-21 20:38 - 2014-04-21 22:07 - 00002277 _____ () C:\Users\Public\Desktop\Treppensoftware- Programme ND.lnk
2014-04-21 20:37 - 2004-11-28 08:43 - 00397312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSRDO20.DLL
2014-04-21 20:37 - 2004-11-28 08:43 - 00151552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdocurs.dll
2014-04-21 20:37 - 2004-11-28 08:43 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RDO20DE.DLL
2014-04-21 20:37 - 2004-11-28 08:42 - 00041316 _____ () C:\WINDOWS\SysWOW64\odbcinst.hlp
2014-04-21 20:37 - 2004-11-28 08:42 - 00026224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ODBC16GT.DLL
2014-04-21 20:37 - 2004-11-28 08:42 - 00007952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbccp32.cpl
2014-04-21 20:37 - 2004-11-28 08:42 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ODBC32GT.DLL
2014-04-21 20:37 - 2004-11-28 08:42 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DS32GT.DLL
2014-04-21 20:37 - 2004-11-28 08:42 - 00004656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DS16GT.DLL
2014-04-21 20:37 - 2004-11-28 08:42 - 00000421 _____ () C:\WINDOWS\SysWOW64\odbcinst.cnt
2014-04-21 20:37 - 2004-11-28 08:34 - 01238288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjt4jlt.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 01050896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00415504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrepl35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00368912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VBAR332.DLL
2014-04-21 20:37 - 2004-11-28 08:34 - 00344064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexch35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxbse35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00252688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00250128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspdox35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00174871 _____ () C:\WINDOWS\SysWOW64\ODBCJET.HLP
2014-04-21 20:37 - 2004-11-28 08:34 - 00168720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msltus35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00166672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstext35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSJINT35.DLL
2014-04-21 20:37 - 2004-11-28 08:34 - 00044304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrpfs35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JETCOMP.exe
2014-04-21 20:37 - 2004-11-28 08:34 - 00024848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjter35.dll
2014-04-21 20:37 - 2004-11-28 08:34 - 00007827 _____ () C:\WINDOWS\SysWOW64\ODBCJET.CNT
2014-04-21 20:37 - 2004-04-19 14:29 - 00339968 _____ (MARX Software Security) C:\WINDOWS\SysWOW64\MPIWIN32.DLL
2014-04-21 20:30 - 2014-04-21 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Compass Software
2014-04-21 20:07 - 2014-04-21 20:07 - 00001444 _____ () C:\Users\Manfred\Downloads\STG06278
2014-04-21 19:57 - 2014-04-21 19:57 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00377856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00214016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2014-04-16 20:55 - 2014-04-16 20:58 - 32099072 _____ () C:\Users\Manfred\Downloads\ServicePack_Nussreiner-20.13.08.21.exe
2014-04-16 20:55 - 2014-04-16 20:56 - 12149248 _____ () C:\Users\Manfred\Downloads\SP_18_1_26_2_14.exe
2014-04-16 20:54 - 2014-04-16 20:59 - 98135552 _____ () C:\Users\Manfred\Downloads\Abb18_0.exe
2014-04-16 16:31 - 2014-04-16 16:51 - 00000156 _____ () C:\Users\Manfred\Desktop\160414_Manfred__PrjData.sbl
2014-04-16 11:06 - 2014-04-25 09:40 - 00000053 _____ () C:\WINDOWS\dach.INI
2014-04-16 10:38 - 2014-04-16 16:51 - 01237890 _____ () C:\Users\Manfred\Desktop\160414_Manfred_.PRT
2014-04-16 10:38 - 2014-04-16 09:41 - 00000470 _____ () C:\Users\Manfred\Desktop\502329_14_NUSSA.MPF
2014-04-16 08:54 - 2014-04-16 09:14 - 01591409 _____ () C:\Users\Manfred\Desktop\Holzbau cad übung.3d
2014-04-16 08:42 - 2014-04-16 08:42 - 00000000 ____D () C:\Users\Manfred\AppData\Local\pcvisit Software AG
2014-04-16 08:41 - 2014-04-16 08:46 - 00000000 ____D () C:\Users\Manfred\Desktop\502329_13_NUSSA_Manfred
2014-04-16 08:40 - 2014-04-16 08:40 - 00000333 _____ () C:\Users\Manfred\Downloads\502329_13_NUSSA_Manfred(1).zip
2014-04-16 08:32 - 2012-08-02 13:19 - 00050688 _____ () C:\WINDOWS\system32\MPDLL.DLL
2014-04-14 12:41 - 2014-04-14 13:33 - 00000683 _____ () C:\Users\Manfred\Desktop\Neues Textdokument.txt
2014-04-09 21:47 - 2014-04-09 21:50 - 22913908 _____ () C:\Users\Manfred\Downloads\torbrowser-install-3.5.4_en-US.exe
2014-04-09 15:09 - 2014-04-09 15:09 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_iBtFltCoex_01009.Wdf
2014-04-09 13:33 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-04-09 13:33 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-04-09 13:33 - 2014-03-10 12:35 - 02008408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-04-09 13:33 - 2014-03-10 12:35 - 00377176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2014-04-09 13:33 - 2014-03-06 11:19 - 01287576 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-04-09 13:33 - 2014-03-06 11:02 - 01109424 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-04-09 13:33 - 2014-03-06 08:17 - 00835584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-04-09 13:33 - 2014-03-06 08:10 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-04-09 13:32 - 2014-04-09 13:32 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-09 13:32 - 2014-04-09 13:32 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-04-09 13:06 - 2014-04-09 13:06 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-04-09 13:01 - 2014-04-09 13:01 - 00001972 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-09 13:01 - 2014-04-09 13:01 - 00001922 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-04-09 13:01 - 2014-04-09 13:01 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Canneverbe Limited
2014-04-09 13:01 - 2014-04-09 13:01 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-04-09 13:00 - 2014-04-09 13:00 - 05290664 _____ (Canneverbe Limited ) C:\Users\Manfred\Downloads\cdbxp_setup_4.5.3.4643.exe
2014-04-09 10:30 - 2014-04-09 10:30 - 00000000 ____D () C:\SAVE EXACT
2014-04-09 10:13 - 2014-04-09 10:14 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\EAC
2014-04-09 10:13 - 2014-04-09 10:14 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\AccurateRip
2014-04-09 10:13 - 2014-04-09 10:13 - 00001093 _____ () C:\Users\Public\Desktop\Exact Audio Copy.lnk
2014-04-09 10:13 - 2014-04-09 10:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
2014-04-09 10:13 - 2014-04-09 10:13 - 00000000 ____D () C:\Program Files (x86)\Exact Audio Copy
2014-04-09 10:11 - 2014-04-09 10:11 - 04422611 _____ () C:\Users\Manfred\Downloads\eac-1.0beta3.exe
2014-04-09 10:05 - 2014-04-09 10:06 - 31524272 _____ (DVDVideoSoft Ltd. ) C:\Users\Manfred\Downloads\FreeAudioCDToMP3Converter_1.3.12.1228.exe
2014-04-03 12:27 - 2014-04-23 19:18 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-03 12:26 - 2014-04-08 20:40 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-03 12:26 - 2014-04-08 20:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-03 12:26 - 2014-04-08 20:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-03 12:26 - 2014-04-03 12:26 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Manfred\Downloads\mbam-setup-2.0.0.1000.exe
2014-04-03 12:26 - 2014-04-03 12:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-03 12:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-03 12:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-03 12:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-03 11:57 - 2014-04-03 11:57 - 13084896 _____ (Microsoft Corporation) C:\Users\Manfred\Downloads\Silverlight_x64.exe
2014-04-02 21:54 - 2014-04-02 21:54 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-04-02 12:28 - 2014-04-02 12:46 - 00013919 _____ () C:\Users\Manfred\Documents\nebenkostenabrechung.xlsx
2014-04-02 01:05 - 2014-04-02 01:05 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Apps\2.0
2014-04-01 23:43 - 2014-04-01 23:43 - 15912395 _____ () C:\Users\Manfred\Downloads\FreenetInstaller-1459.exe
2014-03-31 11:36 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-03-31 11:36 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-03-30 18:06 - 2014-03-30 18:06 - 00000000 ___RD () C:\Users\Manfred\AppData\Roaming\Brother
2014-03-29 23:39 - 2014-03-29 23:39 - 00082047 _____ () C:\Users\Manfred\Downloads\dasessen.swf
2014-03-29 21:34 - 2014-03-29 21:34 - 00000000 ____D () C:\ProgramData\Mozilla
2014-03-29 03:58 - 2014-03-29 03:58 - 00116616 _____ () C:\Users\Manfred\Downloads\wifite_r68.py
2014-03-29 03:57 - 2014-03-29 03:57 - 00033176 _____ () C:\Users\Manfred\Downloads\wifite-2.0r85.tar.gz
2014-03-28 01:23 - 2014-03-28 01:23 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Avira
2014-03-28 01:12 - 2014-03-28 01:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2014-03-28 01:12 - 2014-03-28 01:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-03-28 01:12 - 2014-03-28 01:14 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2014-03-28 01:12 - 2014-03-28 01:12 - 00002093 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\ProgramData\Avira
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-03-28 01:12 - 2013-09-30 12:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2014-03-28 01:05 - 2014-03-28 01:09 - 122946048 _____ () C:\Users\Manfred\Downloads\avira14_free_antivirus_de.exe
2014-03-28 01:04 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

==================== One Month Modified Files and Folders =======

2014-04-25 20:21 - 2014-04-25 20:21 - 00000000 ____D () C:\FRST
2014-04-25 20:21 - 2014-04-25 20:16 - 00000000 ____D () C:\Users\Manfred\Downloads\scan
2014-04-25 20:19 - 2014-04-25 20:19 - 00000168 _____ () C:\Users\Manfred\defogger_reenable
2014-04-25 20:19 - 2014-03-01 15:06 - 00000000 ____D () C:\Users\Manfred
2014-04-25 20:07 - 2014-03-01 14:02 - 00001130 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-25 20:02 - 2013-11-14 09:27 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-25 20:02 - 2013-11-14 09:11 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2014-04-25 20:02 - 2013-11-14 09:11 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2014-04-25 20:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-04-25 19:38 - 2014-03-01 14:59 - 01256904 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-25 16:26 - 2014-03-04 12:21 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\XnView
2014-04-25 16:20 - 2014-03-04 12:20 - 00000000 ____D () C:\Users\Manfred\Desktop\bilder Treppe
2014-04-25 14:44 - 2014-03-01 14:02 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-25 10:51 - 2014-04-25 08:13 - 00000000 ____D () C:\Users\Manfred\Desktop\Manfred
2014-04-25 10:51 - 2013-08-22 16:46 - 00302220 _____ () C:\WINDOWS\setupact.log
2014-04-25 09:40 - 2014-04-16 11:06 - 00000053 _____ () C:\WINDOWS\dach.INI
2014-04-24 23:09 - 2014-04-24 23:09 - 00001290 _____ () C:\Users\Manfred\Desktop\Prüfung Meister - Verknüpfung.lnk
2014-04-24 16:53 - 2014-04-24 16:53 - 00000000 ____D () C:\Program Files\FileOpen
2014-04-24 16:53 - 2014-04-24 16:53 - 00000000 ____D () C:\Program Files (x86)\FileOpen
2014-04-24 16:00 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-23 23:03 - 2014-02-25 19:38 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-985481003-2855859536-316065226-1002
2014-04-23 21:37 - 2014-02-25 20:33 - 00000000 ____D () C:\Program Files (x86)\cadwork.dir
2014-04-23 19:18 - 2014-04-03 12:27 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-04-23 18:32 - 2013-11-14 00:18 - 00056628 _____ () C:\WINDOWS\PFRO.log
2014-04-23 15:16 - 2014-03-04 12:42 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Adobe
2014-04-23 15:15 - 2014-04-23 15:15 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-04-23 15:15 - 2014-04-23 15:15 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-23 15:15 - 2014-03-04 12:42 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-23 15:05 - 2014-04-23 15:05 - 00003172 _____ () C:\WINDOWS\System32\Tasks\{95F2D096-A407-4C8E-A49B-B9B5F98E6F64}
2014-04-22 14:03 - 2014-03-04 22:30 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Microsoft Help
2014-04-21 23:36 - 2014-02-25 21:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\cadwork
2014-04-21 23:23 - 2014-02-25 21:20 - 00001095 _____ () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\cadwork.lnk
2014-04-21 23:21 - 2014-02-25 20:33 - 00000000 ____D () C:\Users\Public\Documents\cadwork
2014-04-21 22:12 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-04-21 22:07 - 2014-04-21 20:38 - 00002277 _____ () C:\Users\Public\Desktop\Treppensoftware- Programme ND.lnk
2014-04-21 21:56 - 2014-04-21 21:56 - 00004224 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 21:56 - 2014-03-24 14:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-21 21:40 - 2014-04-21 21:39 - 02707456 _____ () C:\Users\Manfred\Downloads\FileOpenInstaller64(2).msi
2014-04-21 21:34 - 2014-04-21 21:34 - 02707456 _____ () C:\Users\Manfred\Downloads\FileOpenInstaller64(1).msi
2014-04-21 20:38 - 2014-04-21 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Compass Software
2014-04-21 20:30 - 2013-12-01 07:22 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-21 20:07 - 2014-04-21 20:07 - 00001444 _____ () C:\Users\Manfred\Downloads\STG06278
2014-04-21 19:57 - 2014-04-21 19:57 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00377856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00214016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2014-04-21 19:57 - 2014-04-21 19:57 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2014-04-21 19:57 - 2014-04-21 19:57 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2014-04-20 21:53 - 2014-02-26 16:06 - 00000000 ____D () C:\Megatech
2014-04-16 20:59 - 2014-04-16 20:54 - 98135552 _____ () C:\Users\Manfred\Downloads\Abb18_0.exe
2014-04-16 20:58 - 2014-04-16 20:55 - 32099072 _____ () C:\Users\Manfred\Downloads\ServicePack_Nussreiner-20.13.08.21.exe
2014-04-16 20:56 - 2014-04-16 20:55 - 12149248 _____ () C:\Users\Manfred\Downloads\SP_18_1_26_2_14.exe
2014-04-16 16:51 - 2014-04-16 16:31 - 00000156 _____ () C:\Users\Manfred\Desktop\160414_Manfred__PrjData.sbl
2014-04-16 16:51 - 2014-04-16 10:38 - 01237890 _____ () C:\Users\Manfred\Desktop\160414_Manfred_.PRT
2014-04-16 09:46 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-04-16 09:41 - 2014-04-16 10:38 - 00000470 _____ () C:\Users\Manfred\Desktop\502329_14_NUSSA.MPF
2014-04-16 09:14 - 2014-04-16 08:54 - 01591409 _____ () C:\Users\Manfred\Desktop\Holzbau cad übung.3d
2014-04-16 08:55 - 2014-03-04 10:59 - 00000000 ____D () C:\Users\Manfred\Desktop\backups
2014-04-16 08:46 - 2014-04-16 08:41 - 00000000 ____D () C:\Users\Manfred\Desktop\502329_13_NUSSA_Manfred
2014-04-16 08:42 - 2014-04-16 08:42 - 00000000 ____D () C:\Users\Manfred\AppData\Local\pcvisit Software AG
2014-04-16 08:40 - 2014-04-16 08:40 - 00000333 _____ () C:\Users\Manfred\Downloads\502329_13_NUSSA_Manfred(1).zip
2014-04-14 20:13 - 2014-04-21 21:56 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 21:56 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 21:56 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 21:56 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-04-14 13:33 - 2014-04-14 12:41 - 00000683 _____ () C:\Users\Manfred\Desktop\Neues Textdokument.txt
2014-04-10 08:45 - 2013-08-22 16:44 - 00413296 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Multimedia Platform
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2014-04-10 08:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Multimedia Platform
2014-04-10 08:44 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\oobe
2014-04-10 08:44 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\Dism
2014-04-10 08:44 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\servicing
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\zh-HK
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\uk-UA
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\tr-TR
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\th-TH
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\SystemResetPlatform
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sl-SI
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sk-SK
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\ro-RO
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\migwiz
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\lv-LV
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\lt-LT
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\hr-HR
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\he-IL
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\et-EE
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\en-GB
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\bg-BG
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-04-10 08:43 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-04-10 08:43 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-04-10 08:43 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-04-10 08:43 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Dism
2014-04-10 08:17 - 2014-03-01 14:59 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-04-10 08:17 - 2013-08-22 16:46 - 00000618 _____ () C:\WINDOWS\setuperr.log
2014-04-10 00:59 - 2014-03-23 15:10 - 00000000 ____D () C:\Users\Manfred\Desktop\Laufrouten
2014-04-09 21:53 - 2014-02-25 20:13 - 00000000 ____D () C:\Users\Manfred\Desktop\Tor Browser
2014-04-09 21:50 - 2014-04-09 21:47 - 22913908 _____ () C:\Users\Manfred\Downloads\torbrowser-install-3.5.4_en-US.exe
2014-04-09 15:10 - 2014-03-01 10:21 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-04-09 15:09 - 2014-04-09 15:09 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_iBtFltCoex_01009.Wdf
2014-04-09 15:09 - 2014-03-01 10:21 - 90655440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-04-09 13:32 - 2014-04-09 13:32 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-04-09 13:32 - 2014-04-09 13:32 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-04-09 13:06 - 2014-04-09 13:06 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-04-09 13:01 - 2014-04-09 13:01 - 00001972 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-04-09 13:01 - 2014-04-09 13:01 - 00001922 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-04-09 13:01 - 2014-04-09 13:01 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Canneverbe Limited
2014-04-09 13:01 - 2014-04-09 13:01 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-04-09 13:00 - 2014-04-09 13:00 - 05290664 _____ (Canneverbe Limited ) C:\Users\Manfred\Downloads\cdbxp_setup_4.5.3.4643.exe
2014-04-09 10:45 - 2014-03-01 12:31 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\vlc
2014-04-09 10:30 - 2014-04-09 10:30 - 00000000 ____D () C:\SAVE EXACT
2014-04-09 10:14 - 2014-04-09 10:13 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\EAC
2014-04-09 10:14 - 2014-04-09 10:13 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\AccurateRip
2014-04-09 10:13 - 2014-04-09 10:13 - 00001093 _____ () C:\Users\Public\Desktop\Exact Audio Copy.lnk
2014-04-09 10:13 - 2014-04-09 10:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
2014-04-09 10:13 - 2014-04-09 10:13 - 00000000 ____D () C:\Program Files (x86)\Exact Audio Copy
2014-04-09 10:11 - 2014-04-09 10:11 - 04422611 _____ () C:\Users\Manfred\Downloads\eac-1.0beta3.exe
2014-04-09 10:06 - 2014-04-09 10:05 - 31524272 _____ (DVDVideoSoft Ltd. ) C:\Users\Manfred\Downloads\FreeAudioCDToMP3Converter_1.3.12.1228.exe
2014-04-09 09:50 - 2014-02-26 15:59 - 00000432 _____ () C:\WINDOWS\BRWMARK.INI
2014-04-08 20:40 - 2014-04-03 12:26 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-08 20:40 - 2014-04-03 12:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-08 20:40 - 2014-04-03 12:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-08 00:16 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\System
2014-04-08 00:16 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Resources
2014-04-03 22:29 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-04-03 12:26 - 2014-04-03 12:26 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Manfred\Downloads\mbam-setup-2.0.0.1000.exe
2014-04-03 12:26 - 2014-04-03 12:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-03 11:58 - 2014-04-03 11:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-03 11:57 - 2014-04-03 11:57 - 13084896 _____ (Microsoft Corporation) C:\Users\Manfred\Downloads\Silverlight_x64.exe
2014-04-03 10:29 - 2014-02-26 08:54 - 00007620 _____ () C:\Users\Manfred\AppData\Local\Resmon.ResmonCfg
2014-04-03 09:51 - 2014-04-03 12:26 - 00088280 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-03 12:26 - 00063192 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-03 12:26 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-04-02 21:54 - 2014-04-02 21:54 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-04-02 18:44 - 2014-02-25 19:32 - 00000000 ___RD () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-02 12:46 - 2014-04-02 12:28 - 00013919 _____ () C:\Users\Manfred\Documents\nebenkostenabrechung.xlsx
2014-04-02 01:05 - 2014-04-02 01:05 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Apps\2.0
2014-04-02 00:53 - 2014-02-25 19:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-01 23:43 - 2014-04-01 23:43 - 15912395 _____ () C:\Users\Manfred\Downloads\FreenetInstaller-1459.exe
2014-03-31 23:23 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-03-31 23:23 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-31 03:16 - 2014-04-09 13:33 - 23134208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-03-31 01:57 - 2014-04-09 13:33 - 17073152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-03-30 18:06 - 2014-03-30 18:06 - 00000000 ___RD () C:\Users\Manfred\AppData\Roaming\Brother
2014-03-29 23:39 - 2014-03-29 23:39 - 00082047 _____ () C:\Users\Manfred\Downloads\dasessen.swf
2014-03-29 21:34 - 2014-03-29 21:34 - 00000000 ____D () C:\ProgramData\Mozilla
2014-03-29 03:58 - 2014-03-29 03:58 - 00116616 _____ () C:\Users\Manfred\Downloads\wifite_r68.py
2014-03-29 03:57 - 2014-03-29 03:57 - 00033176 _____ () C:\Users\Manfred\Downloads\wifite-2.0r85.tar.gz
2014-03-29 03:00 - 2014-03-15 02:53 - 00000000 ____D () C:\Users\Manfred\dwhelper
2014-03-28 01:23 - 2014-03-28 01:23 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Avira
2014-03-28 01:17 - 2014-02-25 19:52 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-28 01:14 - 2014-03-28 01:12 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2014-03-28 01:14 - 2014-03-28 01:12 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-03-28 01:14 - 2014-03-28 01:12 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2014-03-28 01:12 - 2014-03-28 01:12 - 00002093 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\ProgramData\Avira
2014-03-28 01:12 - 2014-03-28 01:12 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-03-28 01:09 - 2014-03-28 01:05 - 122946048 _____ () C:\Users\Manfred\Downloads\avira14_free_antivirus_de.exe
2014-03-28 01:05 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-03-28 01:03 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

Some content of TEMP:
====================
C:\Users\Manfred\AppData\Local\Temp\avgnt.exe
C:\Users\Manfred\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Manfred\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Manfred\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\Manfred\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Manfred\AppData\Local\Temp\mirc732.exe
C:\Users\Manfred\AppData\Local\Temp\uninstall.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-22 09:25

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-04-2014 01
Ran by Manfred at 2014-04-25 20:21:33
Running from C:\Users\Manfred\Downloads\scan
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Alcatel onetouch Manager (HKLM-x32\...\{C32EDA33-2F6F-0200-0000-000000000000}) (Version: 13.05.2155 - Mobile Action)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Brother MFC-9320CW (HKLM-x32\...\{FC4E02A9-6C12-4F69-85F6-BFA164105F1F}) (Version: 1.00 - Brother)
Brother MFL-Pro Suite MFC-9320CW (HKLM-x32\...\{A1BBEE16-49B1-42F2-95B8-54C8C6A1C0C3}) (Version: 3.0.3.0 - Brother Industries, Ltd.)
cadwork (HKLM-x32\...\cadwork) (Version: 19.280.0 - Cadwork Informatik)
cadwork (x32 Version: 19.280.0 - Cadwork Informatik) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition update for Microsoft Office 2010 (KB982726) (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{B3AADEEC-7004-4B74-93C2-C3136EA92D76}) (Version:  - Microsoft)
eDocPrintPro v3.17.0 (HKLM\...\{EE92BF61-A3C6-451B-9EA5-34A8C0895B67}) (Version: 3.17.0 - MAY-Computer)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.11 - Lenovo)
Energy Management (x32 Version: 8.0.2.11 - Lenovo) Hidden
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FileOpen Client (x64) B928 (HKLM\...\{3ED9A79B-1419-4C5F-BA88-EFD6F180EBE5}) (Version: 3.0.95.928 - FileOpen Systems, Inc.)
Frilo.System.Next (HKLM-x32\...\{FB83BA58-9E3D-4EDB-B15C-4BB2254E67A2}) (Version: 3.9.11 - Friedrich + Lochner GmbH)
FriloBase (HKLM-x32\...\{4DBEF603-5CE5-4629-8B79-FAA95CC46915}) (Version: 1.0.0 - Friedrich + Lochner GmbH)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.0.3 - Genesys Logic)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
gs_x64 (HKLM\...\{2E415339-7210-4A3B-84EA-E50FE7565F0D}) (Version: 9.00 - MAY-Computer)
Hundegger CAMBIUM 1 (HKLM-x32\...\{96ABFB36-CD65-4F15-907F-7D90E3213007}) (Version: 1.11.22.37426 - Hans Hundegger Maschinenbau GmbH)
Hundegger K2 9 (HKLM-x32\...\{D901B54B-287A-43D0-9DDE-96DFA7A768DD}) (Version: 9.2.1.6797 - Hans Hundegger Maschinenbau GmbH)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel(R) PRO/Wireless Driver (Version: 16.01.5000.0577 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.6.0.1033 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.6.0.1033 - Intel Corporation) Hidden
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)
Intel(R) Update Manager (x32 Version: 1.6.0.56 - Intel Corporation) Hidden
Intel(R) WiDi (HKLM\...\{90621A56-901E-417D-A8CB-E8E3A6793C29}) (Version: 4.1.19.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{aaf3655f-6961-4be2-aa4e-6de4dc1dc8f4}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.5000.0269 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.4.0 - Lenovo)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.1219 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.1219 - CyberLink Corp.) Hidden
Lenovo pointing device (HKLM\...\Elantech) (Version: 11.4.19.2 - ELAN Microelectronic Corp.)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
MegaCAD 2013 3D Nussreiner 2  ServicePack-20.13.08.21  (HKLM-x32\...\MegaCAD 2013 3D Nussreiner 2  ServicePack-20.13.08.21) (Version:  - )
MegaCAD 3D 2013  (HKLM-x32\...\MegaCAD 3D 2013) (Version:  - Megatech Software GmbH)
Megatech Lizenzserver (HKLM-x32\...\Megatech Lizenzserver) (Version: 2.0.0.0 - Megatech Software GmbH)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}) (Version:  - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mIRC (HKLM-x32\...\mIRC) (Version:  - )
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.145.1024 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 327.62 (Version: 327.62 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
PDF-XChange Lite 4 (HKLM\...\{B860298B-CE03-4DE2-B92E-422F2C20A2D8}_is1) (Version: 4.0.201.0 - Tracker Software Products Ltd)
Qualcomm Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.12 - Qualcomm Atheros Communications Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6923 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Shrew Soft VPN Client (HKLM\...\Shrew Soft VPN Client) (Version:  - )
Staircase- Software Programs ND (HKLM-x32\...\{91F52CB7-F113-11D3-B5BA-0000E86AF06F}) (Version: 10.6.0 - Compass Software GmbH)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.621  - Nullsoft, Inc)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XChat 2 (remove only) (HKLM-x32\...\xchat) (Version:  - )
XnView 2.00 (HKLM-x32\...\XnView_is1) (Version: 2.00 - Gougelet Pierre-e)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

==================== Restore Points  =========================

24-04-2014 08:29:43 Removed FileOpen Client (x64) B928
24-04-2014 08:30:32 Installed FileOpen Client (x64) B928

==================== Hosts content: ==========================

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {80F6558E-4332-4A74-BBAF-8083BA0F8946} - System32\Tasks\ISM-UpdateService-e57b59e7-5862-4250-9ce0-76fb411dc0d2-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9EF68C89-28EB-4D22-9CA8-3413F6EAC4CB} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-06-03] (Lenovo)
Task: {A5BACCA4-2968-4CD5-8EF5-9858D0FF2B46} - System32\Tasks\ISM-UpdateService-e57b59e7-5862-4250-9ce0-76fb411dc0d2 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\Bootstrap.exe [2013-03-08] (Intel Corporation)
Task: {AF93630B-97BA-490E-A202-CE587D20E63E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-01] (Google Inc.)
Task: {C71900C1-C22A-4C6C-B837-A7568078DC0C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-04-09] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F09A0D8B-4DEC-4C89-A444-B6C31F10102C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-03-01] (Google Inc.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-07-01 10:21 - 2013-07-01 10:21 - 01127736 _____ () C:\Program Files\ShrewSoft\VPN Client\iked.exe
2013-07-01 01:16 - 2013-07-01 01:16 - 00628224 _____ () C:\Program Files\ShrewSoft\VPN Client\libike.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00039936 _____ () C:\Program Files\ShrewSoft\VPN Client\libvnet.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00018432 _____ () C:\Program Files\ShrewSoft\VPN Client\libith.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00029184 _____ () C:\Program Files\ShrewSoft\VPN Client\libpfk.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00017920 _____ () C:\Program Files\ShrewSoft\VPN Client\libdtp.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00035840 _____ () C:\Program Files\ShrewSoft\VPN Client\libvflt.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00013312 _____ () C:\Program Files\ShrewSoft\VPN Client\liblog.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00116736 _____ () C:\Program Files\ShrewSoft\VPN Client\libip.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00022016 _____ () C:\Program Files\ShrewSoft\VPN Client\libidb.dll
2013-07-01 10:21 - 2013-07-01 10:21 - 00810808 _____ () C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
2014-04-16 08:32 - 2007-12-12 10:29 - 00036864 _____ () C:\Megatech\MProtect\MPSERV.EXE
2014-03-04 12:50 - 2005-04-22 14:36 - 00143360 ____N () C:\WINDOWS\system32\BrSNMP64.dll
2014-03-01 08:58 - 2013-11-01 05:43 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-12-01 07:36 - 2013-04-09 08:39 - 00040960 _____ () C:\Windows\SysWOW64\UMonit64.exe
2014-03-04 12:50 - 2012-09-25 12:26 - 01163264 ____N () C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
2014-03-28 01:12 - 2013-09-30 12:01 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-12-01 07:25 - 2013-05-15 20:08 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-03-04 12:50 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-02-25 19:38 - 2014-03-29 21:34 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Manfred\Desktop\160414_Manfred_.PRT:DocumentSummaryInformation
AlternateDataStreams: C:\Users\Manfred\Desktop\160414_Manfred_.PRT:SebiesnrMkudrfcoIaamtykdDa
AlternateDataStreams: C:\Users\Manfred\Desktop\160414_Manfred_.PRT:SummaryInformation
AlternateDataStreams: C:\Users\Manfred\Desktop\160414_Manfred_.PRT:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Manfred\Desktop\eckig Manfred.PRT:DocumentSummaryInformation
AlternateDataStreams: C:\Users\Manfred\Desktop\eckig Manfred.PRT:SebiesnrMkudrfcoIaamtykdDa
AlternateDataStreams: C:\Users\Manfred\Desktop\eckig Manfred.PRT:SummaryInformation
AlternateDataStreams: C:\Users\Manfred\Desktop\eckig Manfred.PRT:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: AppReadiness => 3
MSCONFIG\Services: Browser => 3
MSCONFIG\Services: FileOpenManager => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3

==================== Faulty Device Manager Devices =============

Name: Shrew Soft Virtual Adapter
Description: Shrew Soft Virtual Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Shrew Soft
Service: vnet
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/25/2014 04:26:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: xnview.exe, Version: 2.0.0.0, Zeitstempel: 0x5163de15
Name des fehlerhaften Moduls: CADImage.DLL, Version: 8.2.0.1, Zeitstempel: 0x500900b8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000047db
ID des fehlerhaften Prozesses: 0x980
Startzeit der fehlerhaften Anwendung: 0xxnview.exe0
Pfad der fehlerhaften Anwendung: xnview.exe1
Pfad des fehlerhaften Moduls: xnview.exe2
Berichtskennung: xnview.exe3
Vollständiger Name des fehlerhaften Pakets: xnview.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: xnview.exe5

Error: (04/25/2014 02:56:06 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Das Volume "Windows8_OS (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (04/25/2014 10:57:47 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:57:47 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:57:46 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:57:46 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:57:08 AM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Das Volume "Windows8_OS (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (04/25/2014 10:56:43 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:56:43 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/25/2014 10:56:42 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (04/25/2014 07:55:18 PM) (Source: DCOM) (User: Manfred2)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (04/25/2014 07:54:48 PM) (Source: DCOM) (User: Manfred2)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (04/25/2014 10:00:01 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (04/25/2014 00:53:48 AM) (Source: Service Control Manager) (User: )
Description: Vom folgenden Dienst wurde wiederholt nicht auf Dienststeuerungsanforderungen reagiert: ShrewSoft IKE Daemon

Erkundigen Sie sich beim Diensthersteller oder beim Systemadministrator danach, ob der Dienst deaktiviert werden sollte, bis das Problem gefunden wurde.

Der Computer muss unter Umständen im abgesicherten Modus gestartet werden, um den Dienst deaktivieren zu können.

Error: (04/24/2014 10:38:13 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.

Error: (04/24/2014 10:37:43 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.

Error: (04/24/2014 09:04:03 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.

Error: (04/24/2014 07:31:32 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.

Error: (04/24/2014 05:46:32 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.

Error: (04/24/2014 05:46:02 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst iked erreicht.


Microsoft Office Sessions:
=========================
Error: (04/25/2014 04:26:03 PM) (Source: Application Error)(User: )
Description: xnview.exe2.0.0.05163de15CADImage.DLL8.2.0.1500900b8c0000005000047db98001cf60924918f596C:\Program Files (x86)\XnView\xnview.exeC:\Program Files (x86)\XnView\Plugins\CADImage.DLL878b6542-cc85-11e3-bea4-00c2c612f4ca

Error: (04/25/2014 02:56:06 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: Windows8_OS (C:)Falscher Parameter. (0x80070057)

Error: (04/25/2014 10:57:47 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\pclib\LxSDK\bin\TKQMesD.dll

Error: (04/25/2014 10:57:47 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\pclib\LxSDK\bin\TKEMesD.dll

Error: (04/25/2014 10:57:46 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\lexocad\dlls\TKEMesD.dll

Error: (04/25/2014 10:57:46 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\lexocad\dlls\TKQMesD.dll

Error: (04/25/2014 10:57:08 AM) (Source: Microsoft-Windows-Defrag)(User: )
Description: Windows8_OS (C:)Falscher Parameter. (0x80070057)

Error: (04/25/2014 10:56:43 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\pclib\LxSDK\bin\TKQMesD.dll

Error: (04/25/2014 10:56:43 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\pclib\LxSDK\bin\TKEMesD.dll

Error: (04/25/2014 10:56:42 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\cadwork.dir\EXE_19\lexocad\dlls\TKEMesD.dll


CodeIntegrity Errors:
===================================
  Date: 2014-03-26 18:07:49.740
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-03-26 18:07:42.223
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-03-12 21:53:18.933
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-03-12 21:53:17.849
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 8104.27 MB
Available physical RAM: 5757.05 MB
Total Pagefile: 9384.27 MB
Available Pagefile: 6867.78 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:890.97 GB) (Free:638.87 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:21.4 GB) NTFS
Drive f: (CADWORK4096) (Removable) (Total:3.72 GB) (Free:0.56 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 6877AA51)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 04030201)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0C)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-25 20:30:25
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000034 ST1000LM014-1EJ164 rev.LVD3 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Manfred\AppData\Local\Temp\pwrdypob.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                              fffff96000157e00 15 bytes [00, FA, 0E, 02, C0, 9C, 70, ...]
.text   C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                         fffff96000157e10 11 bytes [00, 00, FC, FF, 80, FA, C0, ...]

---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation   00007ff894793120 7 bytes JMP 00007ff9921602d0
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW          00007ff894794500 7 bytes JMP 00007ff992160308
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW           00007ff894841200 7 bytes JMP 00007ff992160340
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW            00007ff894841280 7 bytes JMP 00007ff9921603b0
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA            00007ff8948416d0 7 bytes JMP 00007ff992160378
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW   00007ff894847250 7 bytes JMP 00007ff992160260
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx   00007ff89486d840 7 bytes JMP 00007ff992160228
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW     00007ff89486d8b0 7 bytes JMP 00007ff992160298
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW        00007ff8921720f4 7 bytes JMP 00007ff9921600d8
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary             00007ff892175380 5 bytes JMP 00007ff992160180
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW      00007ff8921754b8 5 bytes JMP 00007ff992160110
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW          00007ff892175520 5 bytes JMP 00007ff992160148
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\USER32.dll!CreateWindowExW             00007ff8945b7b64 10 bytes JMP 00007ff992160490
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA         00007ff8945d2910 5 bytes JMP 00007ff992160420
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW         00007ff8945d4578 5 bytes JMP 00007ff992160458
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo  00007ff8945d4980 9 bytes JMP 00007ff9921603e8
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList     00007ff892981500 8 bytes JMP 00007ff9921601b8
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo       00007ff892981750 8 bytes JMP 00007ff9921601f0
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory             00007ff88fdd705c 5 bytes JMP 00007ff98fc500d8
.text   C:\WINDOWS\System32\dwm.exe[3992] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory1            00007ff88fdd7678 5 bytes JMP 00007ff98fc50110
.text   C:\WINDOWS\system32\nvvsvc.exe[3172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506  00007ff8922d169a 4 bytes [2D, 92, F8, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[3172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514  00007ff8922d16a2 4 bytes [2D, 92, F8, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[3172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118     00007ff8922d181a 4 bytes [2D, 92, F8, 7F]
.text   C:\WINDOWS\system32\nvvsvc.exe[3172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142     00007ff8922d1832 4 bytes [2D, 92, F8, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [5072:3088]                                                    fffff960009754d0

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                        unknown MBR code

---- EOF - GMER 2.1 ----
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-25 20:52:21
Windows 6.3.9600  x64 \Device\Harddisk0\DR0 -> \Device\00000034 ST1000LM014-1EJ164 rev.LVD3 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Manfred\AppData\Local\Temp\pwrdypob.sys


---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\Explorer.EXE[392] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 714    00007ffae4a3154a 4 bytes [A3, E4, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[392] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 722    00007ffae4a31552 4 bytes [A3, E4, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[392] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 98   00007ffae4a3162a 4 bytes [A3, E4, FA, 7F]
.text   C:\WINDOWS\Explorer.EXE[392] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 122  00007ffae4a31642 4 bytes [A3, E4, FA, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [492:380]                                            fffff960008bd4d0

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                              unknown MBR code

---- EOF - GMER 2.1 ----