Windows 7: “Trojan.Win32.Jorik.Androm.pep”

Borse · 07.05.2014, 19:59

Hallo,

ich habe eine E-Mail bekommen über eine Rechnung von einem Abo das ich abgeschlossen haben soll. Als ich diese Mail öffnete und dann den Anhang anschauen wollte habe ich mir wohl diesen Trojaner eingefangen.
Über meinen PC komme ich nicht mehr in mein E-Mail Account, da dann eine Meldung kommt dass ein anderer Benutzer sich anmelden wollte und dies aber verhindert wurde. Dann steht dort ich müsste meine Handynummer eingeben um meinen Account wieder zu entsperren, nur funktioniert mein E-Mail Account noch auser auf meinem PC.
Ich kann sonnst keine anderen Sachen sagen, dass mein PC langsamer geworden ist oder desgleichen es funktioniert sonst soweit wie ich es beurteilen kann alles.

Leider hat mein Antivierusprogramm keine Spur entdeckt, ich habe im Internet dann verschiedene Foren durchgelesen aber es hat mich nicht weiter gebracht.
Ich habe mir dann WinZip Malware Protector runtergeladen und er hat dann diese Spuren entdeckt:

Da steht, dass mein Internet Explorer gesperrt ist.

Code:

ATTFilter

c:\program files (x86)\steam\steamtmp.exe

Code:

ATTFilter

c:\users\luke\appdata\roaming\opencandy\32b2d884d1664d248aead4890fe29d85\latestdlmgr.exe

Code:

ATTFilter

c:\program files (x86)\ea games\die sims 2 freizeit-spaß\support\the sims 2 freetime_code.exe

Code:

ATTFilter

hkey_local_machine\software\classes\.bub\

Code:

ATTFilter

hkey_local_machine\software\classes\.bub\content type

Ich weis nicht mehr weiter und hoffe mir kann einer weiterhelfen danke schonmal im Vorraus!

Bootsektor · 07.05.2014, 22:07

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
Poste die Logfiles direkt in deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:

Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Borse · 08.05.2014, 15:19

Oke vielen dank schonmal!

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-05-2014 01
Ran by Luke (administrator) on LUKE-PC on 08-05-2014 16:15:20
Running from C:\Users\Luke\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(ABBYY) C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
(Faronics Corporation) C:\ProgramData\ghriqpr\nbyp.exe
(AVM GmbH) C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Faronics Corporation) C:\ProgramData\fiqbgc\qbsnb.exe
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD8\PDVD8Serv.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUI.exe
(Faronics Corporation) C:\ProgramData\fiqbgc\qbsnb.exe
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
(Faronics Corporation) C:\ProgramData\fiqbgc\qbsnb.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
(Faronics Corporation) C:\ProgramData\fiqbgc\qbsnb.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-06] (Apple Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744 2010-03-26] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-12] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-20] (Microsoft Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-25] (Google Inc.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Joplc\uxpquwlk.exe [84328 2014-05-06] ()
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [suh7hf] - C:\ProgramData\fiqbgc\qbsnb.exe [290816 2014-05-06] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [uo6ao2] - C:\ProgramData\vvqacrs\vjij.exe [290816 2014-05-06] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\ghriqpr\nbyp.exe,explorer.exe <==== ATTENTION 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m3870&r=173602130516pe435v1m5w4551v277
URLSearchHook: HKCU - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} -  No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\snd6g6sw.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-25] ()
R2 ABBYY.Licensing.PDFTransformer.Site License.3.0; C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968 2012-12-14] (Lavasoft Limited)
R2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [126976 2013-11-27] (AVM GmbH)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-04] (GFI Software)
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 16:15 - 2014-05-08 16:15 - 00016302 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 16:13 - 2014-05-08 16:15 - 00000000 ____D () C:\FRST
2014-05-08 16:12 - 2014-05-08 16:12 - 02063872 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:19 - 2014-05-08 16:02 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-05-07 18:19 - 2014-05-07 18:19 - 04892480 _____ (WinZip International LLC ) C:\Users\Luke\Desktop\wzmp_8.exe
2014-05-07 18:19 - 2014-05-07 18:19 - 00001193 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-07 18:19 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\ydnplb
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-07 17:21 - 2014-05-07 17:21 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-06 19:15 - 2014-05-08 15:57 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 16:27 - 2014-05-08 15:57 - 00000000 ____D () C:\ProgramData\qtj
2014-05-06 16:27 - 2014-05-08 15:57 - 00000000 ____D () C:\ProgramData\mnve
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\fiqbgc
2014-05-06 16:24 - 2014-05-08 15:57 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-06 16:23 - 2014-05-06 16:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Joplc
2014-05-06 15:59 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 15:59 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-03 11:47 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 11:47 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 11:47 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 11:47 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 21:14 - 2014-05-05 16:52 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-29 08:58 - 2014-04-30 12:59 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-19 00:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-19 00:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-19 00:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-19 00:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-19 00:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-19 00:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-19 00:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-19 00:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-19 00:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-19 00:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-19 00:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-19 00:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-19 00:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-19 00:21 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-19 00:21 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-19 00:21 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 14:37 - 2014-04-18 13:53 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-09 16:25 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 16:25 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 16:25 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 16:25 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 16:25 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 16:25 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 16:25 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 16:25 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 16:25 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 16:25 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 16:25 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 16:25 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 16:25 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-08 16:15 - 2014-05-08 16:15 - 00016302 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 16:15 - 2014-05-08 16:13 - 00000000 ____D () C:\FRST
2014-05-08 16:14 - 2013-02-04 21:00 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-08 16:12 - 2014-05-08 16:12 - 02063872 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-08 16:04 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-08 16:04 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-08 16:02 - 2014-05-07 18:19 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-05-08 16:02 - 2013-02-04 20:10 - 01359074 _____ () C:\Windows\WindowsUpdate.log
2014-05-08 16:00 - 2013-02-12 17:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-08 15:57 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-08 15:57 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\qtj
2014-05-08 15:57 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\mnve
2014-05-08 15:57 - 2014-05-06 16:24 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-08 15:56 - 2013-02-04 21:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-08 15:56 - 2013-02-04 21:00 - 00001872 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-08 15:56 - 2013-02-04 21:00 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-08 15:56 - 2013-02-04 21:00 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-08 15:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-08 15:55 - 2009-07-14 06:51 - 00139841 _____ () C:\Windows\setupact.log
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:36 - 2013-02-04 20:56 - 00000000 ____D () C:\Users\Luke\AppData\Local\Google
2014-05-07 18:19 - 2014-05-07 18:19 - 04892480 _____ (WinZip International LLC ) C:\Users\Luke\Desktop\wzmp_8.exe
2014-05-07 18:19 - 2014-05-07 18:19 - 00001193 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-07 18:19 - 2014-05-07 18:19 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-07 17:59 - 2010-03-25 22:11 - 00000000 ____D () C:\Program Files (x86)\ABBYY PDF Transformer 3.0
2014-05-07 17:45 - 2014-03-24 14:20 - 00000000 ____D () C:\Users\Luke\Desktop\Jahresbericht
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\ydnplb
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-07 17:21 - 2014-05-07 17:21 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\fiqbgc
2014-05-06 16:23 - 2014-05-06 16:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Joplc
2014-05-05 16:52 - 2014-05-01 21:14 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-05 14:11 - 2013-02-11 20:08 - 00085072 _____ () C:\Users\Luke\AppData\Roaming\GDIPFONTCACHEV1.DAT
2014-05-05 14:05 - 2013-08-27 13:24 - 00000000 ____D () C:\Users\Luke\Desktop\WGL NAdine
2014-05-05 14:05 - 2013-02-05 04:46 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-05-05 14:05 - 2013-02-05 04:46 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-05-05 14:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-04 19:28 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-03 10:09 - 2013-02-04 20:05 - 00866724 _____ () C:\Windows\PFRO.log
2014-05-02 23:26 - 2010-03-25 22:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-02 09:32 - 2013-02-06 21:57 - 00002715 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
2014-05-02 09:30 - 2013-02-04 20:18 - 00085072 _____ () C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-02 09:30 - 2009-07-14 06:45 - 00360728 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-02 09:27 - 2010-03-25 22:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-02 09:27 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-02 09:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Users\Luke\Downloads\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-30 12:59 - 2014-04-29 08:58 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 16:01 - 2014-05-03 11:47 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 15:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-29 14:48 - 2014-05-03 11:47 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:24 - 2013-12-12 19:44 - 00000000 ____D () C:\Users\Luke\Desktop\Nadine
2014-04-29 09:06 - 2014-01-01 20:19 - 00000000 ____D () C:\Users\Luke\Desktop\Samsung s3 Nadine
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-04-29 08:52 - 2013-06-15 17:37 - 00000000 ____D () C:\Users\Luke\Tracing
2014-04-28 19:00 - 2014-03-12 21:00 - 17931952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 19:00 - 2013-02-12 17:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-21 12:40 - 2013-04-21 21:00 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-04-19 10:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-19 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 13:53 - 2014-04-18 14:37 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-14 04:24 - 2014-05-06 15:59 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 15:59 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\Luke\AppData\Local\Temp\53ea8154-070c-477d-bad9-1b5cf42813fb.exe
C:\Users\Luke\AppData\Local\Temp\5ebf68ec-81e7-46d6-8806-4e9bf792cf19.exe
C:\Users\Luke\AppData\Local\Temp\AutoRun.exe
C:\Users\Luke\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Luke\AppData\Local\Temp\binkw32.dll
C:\Users\Luke\AppData\Local\Temp\d2l_Install.exe
C:\Users\Luke\AppData\Local\Temp\d2l_PlayD2.exe
C:\Users\Luke\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Luke\AppData\Local\Temp\drm_dyndata_7370012.dll
C:\Users\Luke\AppData\Local\Temp\eauninstall.exe
C:\Users\Luke\AppData\Local\Temp\First15.exe
C:\Users\Luke\AppData\Local\Temp\msg9194.exe
C:\Users\Luke\AppData\Local\Temp\SIntf16.dll
C:\Users\Luke\AppData\Local\Temp\SIntf32.dll
C:\Users\Luke\AppData\Local\Temp\SIntfNT.dll
C:\Users\Luke\AppData\Local\Temp\The Battle for Middle-earth_uninst.exe
C:\Users\Luke\AppData\Local\Temp\VP6Install.exe
C:\Users\Luke\AppData\Local\Temp\VP6VFW.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 10:18

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-05-2014 01
Ran by Luke at 2014-05-08 16:16:06
Running from C:\Users\Luke\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Lavasoft Ad-Aware (Disabled - Up to date) {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Lavasoft Ad-Aware (Disabled - Up to date) {5BB89C30-6480-BC7C-9F17-199BD76F557A}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Lavasoft Ad-Aware (Disabled) {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}

==================== Installed Programs ======================

AAVUpdateManager (HKLM-x32\...\{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}) (Version: 12.00.0000 - Akademische Arbeitsgemeinschaft)
ABBYY PDF Transformer 3.0 (HKLM-x32\...\ABBYY PDF Transformer 3.0) (Version: 3.00.145.7091 - ABBYY)
ABBYY PDF Transformer 3.0 (Version: 3.00.145.7091 - ABBYY) Hidden
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.2.7222 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.2.7222 - CyberLink Corp.) Hidden
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3007 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.02.0722 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Ad-Aware Antivirus (HKLM-x32\...\{2819e172-81d5-4113-88bd-4605b02344e0}) (Version: 10.4.49.4168 - Lavasoft)
Ad-Aware Security Add-on (HKLM-x32\...\adawaretb) (Version: 2.2.0.18 - Lavasoft)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
AMD DnD V1.0.19 (x32 Version: 1.0.19 - AMD) Hidden
Apple Software Update (HKLM-x32\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
ARMA 2 Operation Arrowhead Uninstall (HKLM-x32\...\ARMA 2 Operation Arrowhead) (Version:  - )
ArmA 2 Uninstall (HKLM-x32\...\ArmA 2) (Version:  - )
ATI AVIVO64 Codecs (Version: 10.12.0.00113 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{C42B7876-FA88-4F4A-9A5F-E175AD143F2A}) (Version: 3.0.762.0 - ATI Technologies, Inc.)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye) (Version:  - )
Brockhaus multimedial 2010 (HKLM-x32\...\{50D69C54-6963-49A6-B762-A9FF8F56AF0F}) (Version: 12.00.0000 - wissenmedia GmbH)
Brother MFL-Pro Suite DCP-145C (HKLM-x32\...\{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0113.2208.39662 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help English (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help French (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help German (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0113.2208.39662 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0113.2208.39662 - ATI) Hidden
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3716.50 - CyberLink Corp.)
CyberLink PowerDVD 8 (x32 Version: 8.0.3716.50 - CyberLink Corp.) Hidden
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Day of Defeat: Source (HKLM-x32\...\Steam App 300) (Version:  - Valve)
Diablo II (HKCU\...\Diablo II) (Version:  - )
Diablo II (HKLM-x32\...\Diablo II) (Version:  - )
Die Sims 2 (HKLM-x32\...\{6E7DD182-9FC6-4651-0095-2E666CC6AF35}) (Version:  - )
Die Sims 2: Nightlife (HKLM-x32\...\{F7529650-B9DB-481B-0089-A2AC3C2821C1}) (Version:  - )
Die Sims 2: Open For Business (HKLM-x32\...\{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}) (Version:  - )
Die Sims 2: Wilde Campus-Jahre (HKLM-x32\...\{01521746-02A6-4A72-00BD-A285DF6B80C6}) (Version:  - )
Die Sims™ 2 Apartment-Leben (HKLM-x32\...\{B6F5B704-06D3-4687-90F3-6195304AD755}) (Version:  - Electronic Arts)
Die Sims™ 2 Freizeit-Spaß (HKLM-x32\...\{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}) (Version:  - Electronic Arts)
Die Sims™ 2 Gute Reise (HKLM-x32\...\{F248ADFA-64E0-4b03-8A83-059078BED6A0}) (Version:  - Electronic Arts)
Die Sims™ 2 Haustiere (HKLM-x32\...\{4817189D-1785-4627-A33C-39FD90919300}) (Version:  - )
Die Sims™ 2 Vier Jahreszeiten (HKLM-x32\...\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}) (Version:  - )
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
EAX4 Unified Redist (HKLM-x32\...\{89661B04-C646-4412-B6D3-5E19F02F1F37}) (Version: 4.001 - Creative Labs)
Empire Earth (HKLM-x32\...\{2447500B-22D7-47BD-9B13-1A927F43A267}) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
FRITZ!Powerline (HKLM-x32\...\{F88975C1-C182-4A51-BEDE-E333AB89F5D4}) (Version: 01.00.57 - AVM Berlin)
Gameforge Live 2.0.1 "Baby Genius" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.1 - Gameforge)
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Half-Life 2: Deathmatch (HKLM-x32\...\Steam App 320) (Version:  - Valve)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 2.05.3003 - Acer Incorporated)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 13 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217013FF}) (Version: 7.0.130 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)
Metin2 (HKLM-x32\...\Metin2_is1) (Version:  - Gameforge 4D GmbH)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
Need for Speed Underground 2 (HKLM-x32\...\{909F8EBC-EC7F-48FF-0085-475D818F0F31}) (Version:  - )
Nero 9 Essentials (HKLM-x32\...\{d1a4e3a6-023d-4c92-84b4-f5e076d26810}) (Version:  - Nero AG)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.7.201 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.7.201 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero Express Help (x32 Version: 9.4.9.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.7.201 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.11.209 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.11.208 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.16.0.100 - Nero AG) Hidden
NeroExpress (x32 Version: 9.4.10.505 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
QuickTime (HKLM-x32\...\{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}) (Version: 7.60.92.0 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5983 - Realtek Semiconductor Corp.)
Skype™ 6.3 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)
Split/Second (HKLM-x32\...\{28526951-55EF-4901-A0CA-B9AC966D1DD1}) (Version: 1.00.0000 - Disney Interactive Studios)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Star Wars Battlefront (HKLM-x32\...\{C79CB9C7-10A4-4814-8402-F574672C2192}) (Version: 1.0 - )
Star Wars Empire at War (HKLM-x32\...\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}) (Version: 1.0 - LucasArts)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Steuer-Spar-Erklärung 2010 (HKLM-x32\...\{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}) (Version: 15.03 - Akademische Arbeitsgemeinschaft Verlag)
Stronghold Crusader (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version:  - )
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3011 - Acer Incorporated)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)

==================== Restore Points  =========================

18-04-2014 12:38:15 FRITZ!Powerline wird installiert
18-04-2014 22:21:24 Windows Update
28-04-2014 18:11:33 Geplanter Prüfpunkt
02-05-2014 07:26:40 Removed Microsoft Office Home and Student 2007
03-05-2014 09:46:49 Windows Update
06-05-2014 15:12:50 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0EAF5853-1146-4017-B280-DB477AE00D5A} - System32\Tasks\{DB9B4AB6-0BE5-4C2A-80E7-8CED444C7A41} => C:\Program Files (x86)\Illusion Softworks\Hidden &amp; Dangerous 2\setup.exe
Task: {21B3385B-F192-4E29-97B3-99AD126901F6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {231A166C-415B-4111-B8A8-6923306967AF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.)
Task: {3D6B8B21-1A33-4721-88C8-993B4E8246BE} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe [2012-12-14] (Lavasoft Limited)
Task: {3E6621F9-DDDE-4637-8F59-F30531B2E3A1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04] (Google Inc.)
Task: {574EE5EA-E2C2-483C-B059-8D6604448A3B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04] (Google Inc.)
Task: {7C67ED2F-4234-4729-A114-7CD8F144BE08} - System32\Tasks\{AE32EA05-83BC-425E-8A58-0332DE843B3E} => C:\Program Files (x86)\Illusion Softworks\Hidden &amp; Dangerous 2\setup.exe
Task: {848608EA-2142-4048-8BDE-26EE9001AACE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {9557964B-B2FC-449B-859A-12EFA9F9E770} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-11-03] (Acer)
Task: {AAB4AF00-643C-4763-A33B-9A6B9E9B8B42} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {AC797F2F-8417-4115-A851-C2E1CACC2644} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {B60EDFEC-045D-4E0F-8B3A-693482736022} - System32\Tasks\{A6CCA88A-9F90-486B-9EF8-F899DB1E26A9} => C:\Program Files (x86)\Illusion Softworks\Hidden &amp; Dangerous 2\setup.exe
Task: {E66EE51E-D6A3-4CD0-95CE-262F6EFAD302} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2008-10-25 01:35 - 2008-10-25 01:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2010-03-26 04:29 - 2010-03-26 04:29 - 00563744 _____ () C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
2009-08-14 11:55 - 2009-08-14 11:55 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-02-04 20:12 - 2013-02-04 20:12 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-05-07 18:19 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-05-07 18:19 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2014-05-07 18:19 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL
2014-01-08 13:40 - 2014-04-22 00:55 - 00340480 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll
2014-04-24 16:15 - 2014-04-22 00:55 - 00471552 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll
2013-03-12 18:10 - 2014-04-01 00:09 - 00754688 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2013-02-04 21:26 - 2014-04-24 00:01 - 01092288 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-02-04 21:26 - 2014-03-03 21:15 - 20626624 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2013-02-04 21:26 - 2013-06-15 01:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2013-02-04 21:26 - 2013-06-15 01:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2013-02-04 21:26 - 2013-06-15 01:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
2013-02-04 21:45 - 2012-11-13 15:06 - 00108960 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-02-04 21:45 - 2012-11-13 15:06 - 00416160 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-02-04 21:45 - 2012-11-13 15:06 - 00158624 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-02-04 21:45 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-02-04 21:45 - 2012-11-13 15:06 - 00528288 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2013-02-04 21:45 - 2012-11-13 15:06 - 00554400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2013-02-06 22:09 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-02-04 21:02 - 2014-04-16 09:17 - 00190752 _____ () C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libBase64.dll
2013-02-04 21:02 - 2014-04-16 09:17 - 00178464 _____ () C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libMachoUniv.dll
2014-03-31 17:10 - 2014-03-31 17:10 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-28 19:00 - 2014-04-28 19:00 - 16351920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service => ""="Ad-Aware Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ad-Aware Service => ""="Ad-Aware Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SBAMSvc => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/08/2014 03:57:45 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000001290
ID des fehlerhaften Prozesses: 0x10f4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (05/08/2014 03:56:27 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000001290
ID des fehlerhaften Prozesses: 0x75c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (05/07/2014 06:03:58 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/07/2014 05:59:54 PM) (Source: Microsoft Office 10) (User: ) (EventID: 1000)
Description: Faulting application winword.exe, version 10.0.2627.0, faulting module pkmws.dll, version 10.145.3722.0, fault address 0x0000a27d.

Error: (05/05/2014 09:14:23 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: adawarebp.exe, Version: 1.0.1.82, Zeitstempel: 0x50aa8d2b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006a6d
ID des fehlerhaften Prozesses: 0x974
Startzeit der fehlerhaften Anwendung: 0xadawarebp.exe0
Pfad der fehlerhaften Anwendung: adawarebp.exe1
Pfad des fehlerhaften Moduls: adawarebp.exe2
Berichtskennung: adawarebp.exe3

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (05/05/2014 03:14:59 PM) (Source: SideBySide) (User: ) (EventID: 35)
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.


System errors:
=============
Error: (05/07/2014 06:12:25 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:51 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:50 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:50 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (05/07/2014 05:43:50 PM) (Source: DCOM) (User: ) (EventID: 10005)
Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}


Microsoft Office Sessions:
=========================
Error: (05/08/2014 03:57:45 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: explorer.exe6.1.7601.175674d672ee4explorer.exe6.1.7601.175674d672ee4c0000005000000000000129010f401cf6ac55b07efa7C:\Windows\explorer.exeC:\Windows\explorer.exebacc36d7-d6b8-11e3-b743-4487fc762afe

Error: (05/08/2014 03:56:27 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Explorer.EXE6.1.7601.175674d672ee4Explorer.EXE6.1.7601.175674d672ee4c0000005000000000000129075c01cf6ac53cb267fcC:\Windows\Explorer.EXEC:\Windows\Explorer.EXE8c4b8745-d6b8-11e3-b743-4487fc762afe

Error: (05/07/2014 06:03:58 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"D:\Bilder\PhotoScape.exe

Error: (05/07/2014 05:59:54 PM) (Source: Microsoft Office 10) (User: ) (EventID: 1000)
Description: winword.exe10.0.2627.0pkmws.dll10.145.3722.00000a27d

Error: (05/05/2014 09:14:23 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: adawarebp.exe1.0.1.8250aa8d2bKERNELBASE.dll6.1.7601.1822951fb1116c000000500006a6d97401cf6858cac56c58C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exeC:\Windows\syswow64\KERNELBASE.dll770730f3-d489-11e3-93d8-4487fc762afe

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksWP.exe

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"C:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksss.exe

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\WksCal.exe

Error: (05/05/2014 03:15:18 PM) (Source: SideBySide) (User: ) (EventID: 33)
Description: msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"c:\Windows\Installer\{62F7DA7E-CCCB-439C-A760-00C3926E761F}\wksdb.exe

Error: (05/05/2014 03:14:59 PM) (Source: SideBySide) (User: ) (EventID: 35)
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 4023.11 MB
Available physical RAM: 2287.54 MB
Total Pagefile: 8044.4 MB
Available Pagefile: 5592.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:454.45 GB) (Free:283.36 GB) NTFS
Drive d: (DATA) (Fixed) (Total:454.96 GB) (Free:392.56 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 3507A950)
Partition 1: (Not Active) - (Size=22 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=455 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Bootsektor · 08.05.2014, 21:18

Hallo Borse,

ja da läuft was

Schritt 1
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 2
Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Schritt 3
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Borse · 09.05.2014, 16:43

Hallo Sandra,

müsste alles deaktiviert gewesen sein!

Code:

ATTFilter

ComboFix 14-05-07.03 - Luke 09.05.2014  17:22:15.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4023.2589 [GMT 2:00]
ausgeführt von:: c:\users\Luke\Desktop\ComboFix.exe
AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\programdata\fiqbgc
c:\programdata\fiqbgc\qbsnb.exe
c:\programdata\ydnplb
c:\programdata\ydnplb\qteq.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-04-09 bis 2014-05-09  ))))))))))))))))))))))))))))))
.
.
2014-05-08 14:13 . 2014-05-08 14:16	--------	d-----w-	C:\FRST
2014-05-07 16:36 . 2014-05-07 16:36	--------	d-sh--w-	c:\users\Luke\AppData\Local\EmieUserList
2014-05-07 16:36 . 2014-05-07 16:36	--------	d-sh--w-	c:\users\Luke\AppData\Local\EmieSiteList
2014-05-07 16:19 . 2014-05-09 15:01	--------	d-----w-	c:\users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-07 15:23 . 2014-05-07 15:23	--------	d-----w-	c:\programdata\qxucn
2014-05-07 15:23 . 2014-05-07 15:23	--------	d-----w-	c:\programdata\lsux
2014-05-07 15:21 . 2014-05-07 15:21	--------	d-----w-	c:\programdata\vklkphx
2014-05-06 17:15 . 2014-05-09 15:28	--------	d-----w-	c:\programdata\tjyai
2014-05-06 17:15 . 2014-05-06 17:15	--------	d-----w-	c:\programdata\vvqacrs
2014-05-06 17:15 . 2014-05-06 17:15	--------	d-----w-	c:\programdata\kwfvi
2014-05-06 15:13 . 2014-05-06 15:13	--------	d-s---w-	c:\windows\system32\CompatTel
2014-05-06 14:27 . 2014-05-09 15:04	--------	d-----w-	c:\programdata\mnve
2014-05-06 14:27 . 2014-05-09 14:54	--------	d-----w-	c:\programdata\qtj
2014-05-06 14:27 . 2014-05-06 14:27	--------	d-----w-	c:\programdata\ral
2014-05-06 14:27 . 2014-05-06 14:27	--------	d-----w-	c:\programdata\ghriqpr
2014-05-06 14:24 . 2014-05-09 15:28	--------	d-----w-	c:\programdata\xvnfhl
2014-05-06 14:23 . 2014-05-06 14:23	--------	d--h--w-	c:\users\Luke\AppData\Roaming\Joplc
2014-05-06 13:59 . 2014-04-14 02:24	465408	----a-w-	c:\windows\system32\aepdu.dll
2014-05-06 13:59 . 2014-04-14 02:19	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-05-03 09:47 . 2014-04-29 14:01	23547904	----a-w-	c:\windows\system32\mshtml.dll
2014-05-03 09:47 . 2014-04-29 13:40	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-05-03 09:47 . 2014-04-29 12:34	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-04-29 06:58 . 2014-04-30 10:59	--------	d-----w-	c:\users\Luke\AppData\Roaming\Skype
2014-04-29 06:58 . 2014-04-29 06:58	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-04-29 06:58 . 2014-04-29 06:58	--------	d-----r-	c:\program files (x86)\Skype
2014-04-29 06:58 . 2014-04-29 06:58	--------	d-----w-	c:\programdata\Skype
2014-04-18 22:21 . 2014-03-06 08:11	5784064	----a-w-	c:\windows\system32\jscript9.dll
2014-04-18 22:21 . 2014-03-06 07:46	4254720	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-04-18 12:38 . 2014-04-18 12:38	--------	d-----w-	c:\program files (x86)\FRITZ!Powerline
2014-04-18 12:38 . 2014-04-18 12:38	--------	d-----w-	c:\program files\WinPcap
2014-04-18 12:38 . 2014-04-18 12:38	--------	d-----w-	c:\program files (x86)\Common Files\Wise Installation Wizard
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-28 17:00 . 2013-02-12 15:06	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-28 17:00 . 2013-02-12 15:06	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-28 17:00 . 2014-03-12 19:00	17931952	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-21 10:40 . 2013-04-21 19:00	21840	----atw-	c:\windows\SysWow64\SIntfNT.dll
2014-04-21 10:40 . 2013-04-21 19:00	17212	----atw-	c:\windows\SysWow64\SIntf32.dll
2014-04-21 10:40 . 2013-04-21 19:00	12067	----atw-	c:\windows\SysWow64\SIntf16.dll
2014-03-04 09:44 . 2014-04-09 14:25	243712	----a-w-	c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-09 14:25	362496	----a-w-	c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-09 14:25	13312	----a-w-	c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-09 14:25	16384	----a-w-	c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-09 14:25	1163264	----a-w-	c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-09 14:25	14336	----a-w-	c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-09 14:25	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-09 14:25	25600	----a-w-	c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-09 14:25	5120	----a-w-	c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-09 14:25	7680	----a-w-	c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-09 14:25	2048	----a-w-	c:\windows\SysWow64\user.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-12-12 87448]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
2012-12-12 10:48	87448	----a-w-	c:\program files (x86)\adawaretb\adawareDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-12-12 87448]
.
[HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41	120104	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-25 39408]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-04-23 1825984]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"zuaeuwlk"="c:\users\Luke\AppData\Roaming\Joplc\uxpquwlk.exe" [2014-05-06 84328]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"uo6ao2"="c:\programdata\vvqacrs\vjij.exe" [2014-05-06 290816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Ad-Aware Antivirus"="c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher --windows-run" [X]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-01-05 413696]
"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2010-03-26 563744]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-13 98304]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-12-22 128296]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-12-22 181480]
"RemoteControl8"="c:\program files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-12-11 542104]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\winlogon]
"shell"="c:\programdata\vklkphx\hjwchu.exe,explorer.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
R2 AVMPowerlineService;AVM FRITZ!Powerline Service;c:\program files (x86)\FRITZ!Powerline\PowerlineService.exe;c:\program files (x86)\FRITZ!Powerline\PowerlineService.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [x]
S2 ABBYY.Licensing.PDFTransformer.Site License.3.0;ABBYY PDF Transformer 3.0 Licensing Service;c:\program files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe;c:\program files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [x]
S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys;c:\windows\SYSNATIVE\drivers\HCW85BDA.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-12 17:00]
.
2014-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04 19:00]
.
2014-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-04 19:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44	137512	----a-w-	c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\snd6g6sw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-BattlEye - c:\program files (x86)\Steam\steam\Bohemia Interactive\ArmA 2 Operation ArrowheadExpansion\BattlEye\UnInstallBE.exe
AddRemove-BattlEye for A2 - c:\program files (x86)\Steam\Bohemia InteractiveBattlEye\UnInstallBE.exe
AddRemove-BattlEye for OA - c:\program files (x86)\Bohemia Interactive\ArmA 2\Expansion\BattlEye\UnInstallBE.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-980718261-2257943446-3452172735-1000\Software\SecuROM\License information*]
"datasecu"=hex:70,ed,7e,b1,64,83,f1,f8,c6,61,10,31,57,d6,6a,8b,59,d4,58,ae,31,
   6f,5b,0e,3e,3c,7d,ba,d7,04,0e,af,18,76,23,8a,61,22,63,ad,bd,93,b6,33,3e,d8,\
"rkeysecu"=hex:30,28,da,67,83,d3,28,c8,bf,45,a3,2c,56,76,6b,02
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programdata\vklkphx\hjwchu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-05-09  17:33:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-05-09 15:33
.
Vor Suchlauf: 10 Verzeichnis(se), 304.219.377.664 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 304.516.628.480 Bytes frei
.
- - End Of File - - 2DE309F9708E4762592A02FE0B0C84A3

Gruß

Lukas

2. Schritt

Code:

ATTFilter

Farbar Service Scanner Version: 03-05-2014
Ran by Luke (administrator) on 09-05-2014 at 17:39:20
Running from "C:\Users\Luke\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

3. Schritt

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2014 01
Ran by Luke (administrator) on LUKE-PC on 09-05-2014 17:42:22
Running from C:\Users\Luke\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Faronics Corporation) C:\ProgramData\vklkphx\hjwchu.exe
(ABBYY) C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-06] (Apple Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744 2010-03-26] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-12] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-25] (Google Inc.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Joplc\uxpquwlk.exe [84328 2014-05-06] ( )
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [uo6ao2] - C:\ProgramData\vvqacrs\vjij.exe [290816 2014-05-06] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\vklkphx\hjwchu.exe,explorer.exe <==== ATTENTION 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} -  No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\snd6g6sw.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-25] ()
R2 ABBYY.Licensing.PDFTransformer.Site License.3.0; C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968 2012-12-14] (Lavasoft Limited)
S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [126976 2013-11-27] (AVM GmbH)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-04] (GFI Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:20 - 2014-05-09 17:33 - 00000000 ____D () C:\Qoobox
2014-05-09 17:20 - 2014-05-09 17:32 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-09 17:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-09 17:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-08 16:15 - 2014-05-09 17:42 - 00012695 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 16:13 - 2014-05-09 17:42 - 00000000 ____D () C:\FRST
2014-05-08 16:12 - 2014-05-09 17:42 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:19 - 2014-05-09 17:01 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-07 17:21 - 2014-05-07 17:21 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-06 19:15 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 16:27 - 2014-05-09 17:04 - 00000000 ____D () C:\ProgramData\mnve
2014-05-06 16:27 - 2014-05-09 16:54 - 00000000 ____D () C:\ProgramData\qtj
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:24 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-06 16:23 - 2014-05-06 16:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Joplc
2014-05-06 15:59 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 15:59 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-03 11:47 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 11:47 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 11:47 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 11:47 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 21:14 - 2014-05-05 16:52 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-29 08:58 - 2014-04-30 12:59 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-19 00:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-19 00:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-19 00:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-19 00:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-19 00:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-19 00:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-19 00:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-19 00:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-19 00:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-19 00:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-19 00:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-19 00:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-19 00:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-19 00:21 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-19 00:21 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-19 00:21 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 14:37 - 2014-04-18 13:53 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-09 16:25 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 16:25 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 16:25 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 16:25 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 16:25 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 16:25 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 16:25 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 16:25 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 16:25 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 16:25 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 16:25 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 16:25 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 16:25 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 16:25 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:42 - 2014-05-08 16:15 - 00012695 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-09 17:42 - 2014-05-08 16:13 - 00000000 ____D () C:\FRST
2014-05-09 17:42 - 2014-05-08 16:12 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:36 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-09 17:36 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:33 - 2014-05-09 17:20 - 00000000 ____D () C:\Qoobox
2014-05-09 17:33 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-09 17:33 - 2014-05-06 16:24 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-09 17:32 - 2014-05-09 17:20 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:28 - 2013-02-04 21:00 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-09 17:28 - 2013-02-04 20:05 - 00867610 _____ () C:\Windows\PFRO.log
2014-05-09 17:28 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-09 17:28 - 2009-07-14 06:51 - 00140009 _____ () C:\Windows\setupact.log
2014-05-09 17:28 - 2009-07-14 04:34 - 69730304 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 17825792 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-09 17:27 - 2013-02-04 21:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-09 17:27 - 2013-02-04 20:10 - 01386633 _____ () C:\Windows\WindowsUpdate.log
2014-05-09 17:16 - 2013-02-04 21:00 - 00001872 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-09 17:14 - 2013-02-04 21:00 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-09 17:04 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\mnve
2014-05-09 17:04 - 2013-02-04 21:00 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-09 17:03 - 2013-02-04 21:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-09 17:01 - 2014-05-07 18:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-09 17:00 - 2013-02-12 17:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-09 16:54 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\qtj
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:36 - 2013-02-04 20:56 - 00000000 ____D () C:\Users\Luke\AppData\Local\Google
2014-05-07 17:59 - 2010-03-25 22:11 - 00000000 ____D () C:\Program Files (x86)\ABBYY PDF Transformer 3.0
2014-05-07 17:45 - 2014-03-24 14:20 - 00000000 ____D () C:\Users\Luke\Desktop\Jahresbericht
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-07 17:21 - 2014-05-07 17:21 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:23 - 2014-05-06 16:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Joplc
2014-05-05 16:52 - 2014-05-01 21:14 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-05 14:11 - 2013-02-11 20:08 - 00085072 _____ () C:\Users\Luke\AppData\Roaming\GDIPFONTCACHEV1.DAT
2014-05-05 14:05 - 2013-08-27 13:24 - 00000000 ____D () C:\Users\Luke\Desktop\WGL NAdine
2014-05-05 14:05 - 2013-02-05 04:46 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-05-05 14:05 - 2013-02-05 04:46 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-05-05 14:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-04 19:28 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-02 23:26 - 2010-03-25 22:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-02 09:32 - 2013-02-06 21:57 - 00002715 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
2014-05-02 09:30 - 2013-02-04 20:18 - 00085072 _____ () C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-02 09:30 - 2009-07-14 06:45 - 00360728 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-02 09:27 - 2010-03-25 22:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-02 09:27 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-02 09:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Users\Luke\Downloads\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-30 12:59 - 2014-04-29 08:58 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 16:01 - 2014-05-03 11:47 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 15:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-29 14:48 - 2014-05-03 11:47 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:24 - 2013-12-12 19:44 - 00000000 ____D () C:\Users\Luke\Desktop\Nadine
2014-04-29 09:06 - 2014-01-01 20:19 - 00000000 ____D () C:\Users\Luke\Desktop\Samsung s3 Nadine
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-04-29 08:52 - 2013-06-15 17:37 - 00000000 ____D () C:\Users\Luke\Tracing
2014-04-28 19:00 - 2014-03-12 21:00 - 17931952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 19:00 - 2013-02-12 17:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-21 12:40 - 2013-04-21 21:00 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-04-19 10:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-19 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 13:53 - 2014-04-18 14:37 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-14 04:24 - 2014-05-06 15:59 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 15:59 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 10:18

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Bootsektor · 09.05.2014, 23:23

Hallo Borse,

da müssen wir nochmal hinterher.

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Joplc\uxpquwlk.exe [84328 2014-05-06] ( )
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [uo6ao2] - C:\ProgramData\vvqacrs\vjij.exe [290816 2014-05-06] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\vklkphx\hjwchu.exe,explorer.exe <==== ATTENTION 
C:\ProgramData\vvqacrs\
C:\Users\Luke\AppData\Roaming\Joplc\
C:\ProgramData\vklkphx\
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-06 19:15 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 16:27 - 2014-05-09 17:04 - 00000000 ____D () C:\ProgramData\mnve
2014-05-06 16:27 - 2014-05-09 16:54 - 00000000 ____D () C:\ProgramData\qtj
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:24 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\xvnfhl
cmd: type C:\Windows\system32\Drivers\etc\hosts

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Borse · 10.05.2014, 09:31

Hallo Sandra,

1.Schritt

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-05-2014 01
Ran by Luke at 2014-05-10 10:17:18 Run:1
Running from C:\Users\Luke\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
(Faronics Corporation) C:\ProgramData\vvqacrs\vjij.exe
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Joplc\uxpquwlk.exe [84328 2014-05-06] ( )
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [uo6ao2] - C:\ProgramData\vvqacrs\vjij.exe [290816 2014-05-06] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\vklkphx\hjwchu.exe,explorer.exe <==== ATTENTION 
C:\ProgramData\vvqacrs\
C:\Users\Luke\AppData\Roaming\Joplc\
C:\ProgramData\vklkphx\
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\qxucn
2014-05-07 17:23 - 2014-05-07 17:23 - 00000000 ____D () C:\ProgramData\lsux
2014-05-06 19:15 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-06 19:15 - 2014-05-06 19:15 - 00000000 ____D () C:\ProgramData\kwfvi
2014-05-06 16:27 - 2014-05-09 17:04 - 00000000 ____D () C:\ProgramData\mnve
2014-05-06 16:27 - 2014-05-09 16:54 - 00000000 ____D () C:\ProgramData\qtj
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ral
2014-05-06 16:27 - 2014-05-06 16:27 - 00000000 ____D () C:\ProgramData\ghriqpr
2014-05-06 16:24 - 2014-05-09 17:33 - 00000000 ____D () C:\ProgramData\xvnfhl
cmd: type C:\Windows\system32\Drivers\etc\hosts
         
*****************

[2524] C:\ProgramData\vvqacrs\vjij.exe => Process closed successfully.
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\Software\Microsoft\Windows\CurrentVersion\Run\\zuaeuwlk => Value deleted successfully.
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\uo6ao2 => Value deleted successfully.
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\ProgramData\vvqacrs => Moved successfully.
C:\Users\Luke\AppData\Roaming\Joplc => Moved successfully.
C:\ProgramData\vklkphx => Moved successfully.
C:\ProgramData\qxucn => Moved successfully.
C:\ProgramData\lsux => Moved successfully.
C:\ProgramData\tjyai => Moved successfully.
C:\ProgramData\kwfvi => Moved successfully.
C:\ProgramData\mnve => Moved successfully.
C:\ProgramData\qtj => Moved successfully.
C:\ProgramData\ral => Moved successfully.
C:\ProgramData\ghriqpr => Moved successfully.
C:\ProgramData\xvnfhl => Moved successfully.

=========  type C:\Windows\system32\Drivers\etc\hosts =========

127.0.0.1       localhost

========= End of CMD: =========


==== End of Fixlog ====

2.Schritt

Es gab ein kurzes Problem, der FRST hing kurz beim scannen es stand keine Rückmeldung und dann hat er wieder weiter gescannt ich weis nicht ob das schlimm ist oder nicht.

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2014 01
Ran by Luke (administrator) on LUKE-PC on 10-05-2014 10:19:41
Running from C:\Users\Luke\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(ABBYY) C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
() C:\ProgramData\vklkphx\hjwchu.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD8\PDVD8Serv.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe
(Microsoft) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUI.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-06] (Apple Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744 2010-03-26] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-12] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-25] (Google Inc.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Inqi\iltlbcuwlk.exe [143872 2014-05-09] ()
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [uo6ao2] - C:\ProgramData\vvqacrs\vjij.exe
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\vklkphx\hjwchu.exe,explorer.exe <==== ATTENTION 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} -  No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\snd6g6sw.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-25] ()
R2 ABBYY.Licensing.PDFTransformer.Site License.3.0; C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968 2012-12-14] (Lavasoft Limited)
S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [126976 2013-11-27] (AVM GmbH)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-04] (GFI Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-10 10:28 - 2014-05-10 10:28 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-10 10:28 - 2014-05-10 10:28 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-10 10:17 - 2014-05-10 10:17 - 00000000 ____D () C:\ProgramData\mnve
2014-05-09 23:23 - 2014-05-09 23:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Inqi
2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:20 - 2014-05-09 17:33 - 00000000 ____D () C:\Qoobox
2014-05-09 17:20 - 2014-05-09 17:32 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-09 17:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-09 17:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-08 16:15 - 2014-05-10 10:19 - 00014314 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 16:13 - 2014-05-10 10:19 - 00000000 ____D () C:\FRST
2014-05-08 16:12 - 2014-05-09 17:42 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:19 - 2014-05-09 17:01 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 15:59 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 15:59 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-03 11:47 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 11:47 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 11:47 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 11:47 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 21:14 - 2014-05-05 16:52 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-29 08:58 - 2014-04-30 12:59 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-19 00:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-19 00:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-19 00:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-19 00:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-19 00:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-19 00:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-19 00:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-19 00:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-19 00:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-19 00:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-19 00:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-19 00:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-19 00:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-19 00:21 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-19 00:21 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-19 00:21 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 14:37 - 2014-04-18 13:53 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe

==================== One Month Modified Files and Folders =======

2014-05-10 10:28 - 2014-05-10 10:28 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-10 10:28 - 2014-05-10 10:28 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-10 10:26 - 2014-05-08 16:15 - 00014314 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-10 10:19 - 2014-05-08 16:13 - 00000000 ____D () C:\FRST
2014-05-10 10:19 - 2013-02-04 21:00 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-10 10:19 - 2013-02-04 21:00 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-10 10:17 - 2014-05-10 10:17 - 00000000 ____D () C:\ProgramData\mnve
2014-05-10 10:14 - 2013-02-04 21:00 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 10:14 - 2013-02-04 21:00 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-10 10:08 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-10 10:08 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-10 10:02 - 2013-02-04 21:00 - 00001872 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-10 10:01 - 2013-02-04 21:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-10 10:01 - 2013-02-04 21:00 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-10 10:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-10 10:01 - 2009-07-14 06:51 - 00140177 _____ () C:\Windows\setupact.log
2014-05-09 23:24 - 2013-02-04 20:10 - 01393610 _____ () C:\Windows\WindowsUpdate.log
2014-05-09 23:23 - 2014-05-09 23:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Inqi
2014-05-09 23:00 - 2013-02-12 17:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:42 - 2014-05-08 16:12 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:33 - 2014-05-09 17:20 - 00000000 ____D () C:\Qoobox
2014-05-09 17:33 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-05-09 17:32 - 2014-05-09 17:20 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:28 - 2013-02-04 20:05 - 00867610 _____ () C:\Windows\PFRO.log
2014-05-09 17:28 - 2009-07-14 04:34 - 69730304 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 17825792 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-09 17:03 - 2013-02-04 21:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-09 17:01 - 2014-05-07 18:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:36 - 2013-02-04 20:56 - 00000000 ____D () C:\Users\Luke\AppData\Local\Google
2014-05-07 17:59 - 2010-03-25 22:11 - 00000000 ____D () C:\Program Files (x86)\ABBYY PDF Transformer 3.0
2014-05-07 17:45 - 2014-03-24 14:20 - 00000000 ____D () C:\Users\Luke\Desktop\Jahresbericht
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 16:52 - 2014-05-01 21:14 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-05 14:11 - 2013-02-11 20:08 - 00085072 _____ () C:\Users\Luke\AppData\Roaming\GDIPFONTCACHEV1.DAT
2014-05-05 14:05 - 2013-08-27 13:24 - 00000000 ____D () C:\Users\Luke\Desktop\WGL NAdine
2014-05-05 14:05 - 2013-02-05 04:46 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-05-05 14:05 - 2013-02-05 04:46 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-05-05 14:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-04 19:28 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-02 23:26 - 2010-03-25 22:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-02 09:32 - 2013-02-06 21:57 - 00002715 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
2014-05-02 09:30 - 2013-02-04 20:18 - 00085072 _____ () C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-02 09:30 - 2009-07-14 06:45 - 00360728 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-02 09:27 - 2010-03-25 22:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-02 09:27 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-02 09:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Users\Luke\Downloads\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-30 12:59 - 2014-04-29 08:58 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 16:01 - 2014-05-03 11:47 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 15:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-29 14:48 - 2014-05-03 11:47 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:24 - 2013-12-12 19:44 - 00000000 ____D () C:\Users\Luke\Desktop\Nadine
2014-04-29 09:06 - 2014-01-01 20:19 - 00000000 ____D () C:\Users\Luke\Desktop\Samsung s3 Nadine
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-04-29 08:52 - 2013-06-15 17:37 - 00000000 ____D () C:\Users\Luke\Tracing
2014-04-28 19:00 - 2014-03-12 21:00 - 17931952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 19:00 - 2013-02-12 17:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-21 12:40 - 2013-04-21 21:00 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-04-19 10:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-19 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 13:53 - 2014-04-18 14:37 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-14 04:24 - 2014-05-06 15:59 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 15:59 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 18:03

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Bootsektor · 10.05.2014, 22:42

Hallo Borse,

es läuft schon wieder...

Schritt 1
Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Entpacke das Archiv auf deinem Desktop.
Im neu erstellten Ordner starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Bitte mache auch noch einen Scan aus der Recovery

Schritt 2

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.
Während dem Hochfahren drücke mehrmals die F8 Taste
Wähle nun Computer reparieren.
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.
Starte den Rechner neu und starte von der CD.
Wähle die Spracheinstellungen und klicke "Weiter".
Klicke auf Computerreparaturoptionen !
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.
Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
Schließe Notepad wieder
Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Borse · 11.05.2014, 19:23

Hallo Sandra,

ich habe wie in Schritt 1 das Programm durchlaufen lassen. Als es fertig war stand dann dort:" Scan Finished: No malware found!"
Also es lief nur das erste mal durch und ich konnte kein CleanUp Butten drücken da nichts gefunden wurde.

Was bedeutet das jetzt?
Ist der PC frei von dem Virus?

Was soll ich jetzt tun?

Grüße

Lukas

Hallo Sandra,

bei mir lief Ad-Aware durch und hat was gefunden und in die Quarantäne gestellt soll ich diese Löschen oder was soll ich tun?

Grüße

Lukas

Bootsektor · 11.05.2014, 22:58

Hallo Lukas,

was hat ad-aware wo gefunden?

Nein du hast immer noch Malware auf deinem Rechner, bitte mache Schritt 2 aus meinem vorherigen Post.

Borse · 12.05.2014, 15:10

Hallo Sandra,

ich weis nicht wie ich es dir am besten zeigen könnte weil ich kann leider nichts kopieren und hier einfügen. Also die Spur was er entdeckt hat wollte ich kopieren aber es funktioniert nicht wie soll ich es dir am besten zeigen?

Der Name des Trojaners ist: "Trojan.Win32.Generic!BT

Führe jetzt Schritt 2 durch

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01
Ran by SYSTEM on MININT-542DVK9 on 12-05-2014 16:25:10
Running from H:\
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.



==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-05] (Apple Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744 2010-03-25] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-03] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-11] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-21] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-21] ()
HKU\Luke\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-25] (Google Inc.)
HKU\Luke\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-23] (Valve Corporation)
HKU\Luke\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Roaqw\rymaxsuwlk.exe [129536 2014-05-10] ()
HKU\Luke\...\RunOnce: [je1x7] - C:\ProgramData\yxjnmxu\cnkb.exe [307200 2014-05-11] (Faronics Corporation)
HKU\Luke\...\RunOnce: [yp3bg] - C:\ProgramData\qxh\beaslfh.exe [306688 2014-05-10] (Faronics Corporation)
HKU\Luke\...\RunOnce: [x7j24] - C:\ProgramData\hoqjaw\udgglt.exe [306176 2014-05-12] (Faronics Corporation)
HKU\Luke\...\RunOnce: [8tl0ou] - C:\ProgramData\fuauw\krhgelx.exe [307200 2014-05-10] (Faronics Corporation)
HKU\Luke\...\Winlogon: [Shell] C:\ProgramData\fys\vsnqpw.exe,explorer.exe <==== ATTENTION 

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 ABBYY.Licensing.PDFTransformer.Site License.3.0; C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968 2012-12-14] (Lavasoft Limited)
S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [126976 2013-11-27] (AVM GmbH)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
S2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-19] (GFI Software)

==================== Drivers (Whitelisted) ====================

S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-04] (GFI Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-12 05:59 - 2014-05-12 05:59 - 00000000 ____D () C:\ProgramData\lgyx
2014-05-12 04:41 - 2014-05-12 05:59 - 00000000 ____D () C:\ProgramData\xbq
2014-05-12 04:41 - 2014-05-12 04:41 - 00000000 ____D () C:\ProgramData\hoqjaw
2014-05-12 04:41 - 2014-05-12 04:41 - 00000000 ____D () C:\ProgramData\hcdja
2014-05-12 04:36 - 2014-05-12 04:36 - 00000000 ____D () C:\ProgramData\sfa
2014-05-11 12:22 - 2014-05-11 12:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 09:02 - 2014-05-12 05:59 - 00000000 ____D () C:\ProgramData\dhcu
2014-05-11 09:02 - 2014-05-11 09:02 - 00000000 ____D () C:\ProgramData\yxjnmxu
2014-05-11 09:02 - 2014-05-11 09:02 - 00000000 ____D () C:\ProgramData\ipmftlr
2014-05-11 08:53 - 2014-05-11 08:53 - 00000000 ____D () C:\ProgramData\whi
2014-05-11 00:36 - 2014-05-11 01:00 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-11 00:36 - 2014-05-11 00:36 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-05-11 00:35 - 2014-05-11 01:00 - 00000000 ____D () C:\Users\Luke\Desktop\mbar
2014-05-11 00:35 - 2014-05-11 00:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-05-11 00:34 - 2014-05-11 00:34 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Luke\Desktop\mbar-1.07.0.1009.exe
2014-05-10 23:50 - 2014-05-12 06:00 - 00000000 ____D () C:\ProgramData\sdwvfw
2014-05-10 23:50 - 2014-05-10 23:50 - 00000000 ____D () C:\ProgramData\gifk
2014-05-10 23:50 - 2014-05-10 23:50 - 00000000 ____D () C:\ProgramData\fuauw
2014-05-10 23:49 - 2014-05-10 23:49 - 00000000 ____D () C:\ProgramData\fys
2014-05-10 11:14 - 2014-05-10 11:14 - 00000000 ____D () C:\ProgramData\xvnf
2014-05-10 06:48 - 2014-05-12 05:59 - 00000000 ____D () C:\ProgramData\uonhk
2014-05-10 06:48 - 2014-05-10 06:48 - 00000000 ____D () C:\ProgramData\qxh
2014-05-10 06:48 - 2014-05-10 06:48 - 00000000 ____D () C:\ProgramData\lsux
2014-05-10 05:37 - 2014-05-10 05:37 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Roaqw
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\yywnqlx
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\yxjsm
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\saycy
2014-05-10 02:47 - 2014-05-12 06:00 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-10 00:30 - 2014-05-10 23:49 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-10 00:28 - 2014-05-11 08:53 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-10 00:28 - 2014-05-11 08:53 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-10 00:17 - 2014-05-12 06:01 - 00000000 ____D () C:\ProgramData\mnve
2014-05-09 13:23 - 2014-05-09 13:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Inqi
2014-05-09 07:42 - 2014-05-09 07:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 07:39 - 2014-05-09 07:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 07:38 - 2014-05-09 07:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 07:33 - 2014-05-09 07:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 07:20 - 2014-05-09 07:33 - 00000000 ____D () C:\Qoobox
2014-05-09 07:20 - 2014-05-09 07:32 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 07:20 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-09 07:20 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-09 07:20 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-09 07:20 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-09 07:20 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-09 07:20 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-09 07:20 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-09 07:20 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-09 06:58 - 2014-05-09 06:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 06:16 - 2014-05-08 06:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-08 06:15 - 2014-05-10 00:29 - 00033448 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 06:13 - 2014-05-12 16:25 - 00000000 ____D () C:\FRST
2014-05-08 06:12 - 2014-05-09 07:42 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-07 08:36 - 2014-05-07 08:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 08:36 - 2014-05-07 08:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 08:19 - 2014-05-09 07:01 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-06 07:13 - 2014-05-06 07:13 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-06 05:59 - 2014-04-13 18:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-06 05:59 - 2014-04-13 18:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-03 01:47 - 2014-04-29 06:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-03 01:47 - 2014-04-29 05:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-03 01:47 - 2014-04-29 04:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 01:47 - 2014-04-29 04:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 11:14 - 2014-05-05 06:52 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-01 11:03 - 2014-05-01 11:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-28 22:58 - 2014-04-30 02:59 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-28 22:58 - 2014-04-28 22:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-28 22:58 - 2014-04-28 22:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-18 14:22 - 2014-03-06 01:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-04-18 14:22 - 2014-03-06 00:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-04-18 14:22 - 2014-03-06 00:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-04-18 14:22 - 2014-03-06 00:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-04-18 14:22 - 2014-03-06 00:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-04-18 14:22 - 2014-03-06 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-04-18 14:22 - 2014-03-06 00:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-04-18 14:22 - 2014-03-06 00:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-04-18 14:22 - 2014-03-06 00:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-04-18 14:22 - 2014-03-06 00:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-04-18 14:22 - 2014-03-06 00:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-04-18 14:22 - 2014-03-06 00:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-04-18 14:22 - 2014-03-06 00:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-04-18 14:22 - 2014-03-06 00:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-04-18 14:22 - 2014-03-06 00:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-18 14:22 - 2014-03-06 00:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-18 14:22 - 2014-03-06 00:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-18 14:22 - 2014-03-05 23:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-04-18 14:22 - 2014-03-05 23:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-04-18 14:22 - 2014-03-05 23:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-18 14:22 - 2014-03-05 23:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-18 14:22 - 2014-03-05 23:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-18 14:22 - 2014-03-05 23:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-04-18 14:22 - 2014-03-05 23:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-18 14:22 - 2014-03-05 23:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-18 14:22 - 2014-03-05 23:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-18 14:22 - 2014-03-05 23:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-18 14:22 - 2014-03-05 23:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-04-18 14:22 - 2014-03-05 23:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-18 14:22 - 2014-03-05 23:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-04-18 14:22 - 2014-03-05 23:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-18 14:22 - 2014-03-05 23:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-18 14:22 - 2014-03-05 22:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-04-18 14:22 - 2014-03-05 22:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-18 14:22 - 2014-03-05 22:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-18 14:22 - 2014-03-05 22:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-04-18 14:22 - 2014-03-05 21:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-04-18 14:22 - 2014-03-05 21:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-04-18 14:22 - 2014-03-05 21:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-18 14:22 - 2014-03-05 21:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-18 14:22 - 2014-03-05 21:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-18 14:21 - 2014-03-06 00:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-04-18 14:21 - 2014-03-05 23:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-18 14:21 - 2014-03-05 22:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 04:38 - 2014-04-18 04:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 04:38 - 2014-04-18 04:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 04:38 - 2014-04-18 04:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 04:37 - 2014-04-18 03:53 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe

==================== One Month Modified Files and Folders =======

2014-05-12 16:25 - 2014-05-08 06:13 - 00000000 ____D () C:\FRST
2014-05-12 06:19 - 2013-02-04 11:00 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-12 06:19 - 2013-02-04 10:10 - 01451442 _____ () C:\Windows\WindowsUpdate.log
2014-05-12 06:16 - 2013-02-04 18:46 - 00699432 _____ () C:\Windows\System32\perfh007.dat
2014-05-12 06:16 - 2013-02-04 18:46 - 00149572 _____ () C:\Windows\System32\perfc007.dat
2014-05-12 06:16 - 2009-07-13 21:13 - 01620684 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-12 06:14 - 2009-07-13 20:51 - 00141252 _____ () C:\Windows\setupact.log
2014-05-12 06:06 - 2009-07-13 20:45 - 00009696 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-12 06:06 - 2009-07-13 20:45 - 00009696 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-12 06:02 - 2013-02-04 11:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-12 06:01 - 2014-05-10 00:17 - 00000000 ____D () C:\ProgramData\mnve
2014-05-12 06:00 - 2014-05-10 23:50 - 00000000 ____D () C:\ProgramData\sdwvfw
2014-05-12 06:00 - 2014-05-10 02:47 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-12 06:00 - 2013-02-12 07:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-12 06:00 - 2013-02-04 11:00 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-12 05:59 - 2014-05-12 05:59 - 00000000 ____D () C:\ProgramData\lgyx
2014-05-12 05:59 - 2014-05-12 04:41 - 00000000 ____D () C:\ProgramData\xbq
2014-05-12 05:59 - 2014-05-11 09:02 - 00000000 ____D () C:\ProgramData\dhcu
2014-05-12 05:59 - 2014-05-10 06:48 - 00000000 ____D () C:\ProgramData\uonhk
2014-05-12 05:59 - 2013-02-04 11:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-12 05:59 - 2013-02-04 11:00 - 00001872 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-12 05:59 - 2013-02-04 11:00 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-12 05:59 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-12 04:41 - 2014-05-12 04:41 - 00000000 ____D () C:\ProgramData\hoqjaw
2014-05-12 04:41 - 2014-05-12 04:41 - 00000000 ____D () C:\ProgramData\hcdja
2014-05-12 04:36 - 2014-05-12 04:36 - 00000000 ____D () C:\ProgramData\sfa
2014-05-11 12:22 - 2014-05-11 12:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 09:02 - 2014-05-11 09:02 - 00000000 ____D () C:\ProgramData\yxjnmxu
2014-05-11 09:02 - 2014-05-11 09:02 - 00000000 ____D () C:\ProgramData\ipmftlr
2014-05-11 08:53 - 2014-05-11 08:53 - 00000000 ____D () C:\ProgramData\whi
2014-05-11 08:53 - 2014-05-10 00:28 - 00000000 ____D () C:\ProgramData\vvqacrs
2014-05-11 08:53 - 2014-05-10 00:28 - 00000000 ____D () C:\ProgramData\vklkphx
2014-05-11 01:00 - 2014-05-11 00:36 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-11 01:00 - 2014-05-11 00:35 - 00000000 ____D () C:\Users\Luke\Desktop\mbar
2014-05-11 00:36 - 2014-05-11 00:36 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-05-11 00:35 - 2014-05-11 00:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-05-11 00:34 - 2014-05-11 00:34 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Luke\Desktop\mbar-1.07.0.1009.exe
2014-05-10 23:50 - 2014-05-10 23:50 - 00000000 ____D () C:\ProgramData\gifk
2014-05-10 23:50 - 2014-05-10 23:50 - 00000000 ____D () C:\ProgramData\fuauw
2014-05-10 23:49 - 2014-05-10 23:49 - 00000000 ____D () C:\ProgramData\fys
2014-05-10 23:49 - 2014-05-10 00:30 - 00000000 ____D () C:\ProgramData\tjyai
2014-05-10 11:14 - 2014-05-10 11:14 - 00000000 ____D () C:\ProgramData\xvnf
2014-05-10 06:48 - 2014-05-10 06:48 - 00000000 ____D () C:\ProgramData\qxh
2014-05-10 06:48 - 2014-05-10 06:48 - 00000000 ____D () C:\ProgramData\lsux
2014-05-10 05:37 - 2014-05-10 05:37 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Roaqw
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\yywnqlx
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\yxjsm
2014-05-10 02:53 - 2014-05-10 02:53 - 00000000 ____D () C:\ProgramData\saycy
2014-05-10 00:29 - 2014-05-08 06:15 - 00033448 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-10 00:14 - 2013-02-04 11:00 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 00:14 - 2013-02-04 11:00 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-09 13:23 - 2014-05-09 13:23 - 00000000 ___HD () C:\Users\Luke\AppData\Roaming\Inqi
2014-05-09 07:42 - 2014-05-09 07:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 07:42 - 2014-05-08 06:12 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-09 07:39 - 2014-05-09 07:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 07:38 - 2014-05-09 07:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 07:33 - 2014-05-09 07:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 07:33 - 2014-05-09 07:20 - 00000000 ____D () C:\Qoobox
2014-05-09 07:33 - 2009-07-13 19:20 - 00000000 __RHD () C:\users\Default
2014-05-09 07:32 - 2014-05-09 07:20 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 07:28 - 2013-02-04 10:05 - 00867610 _____ () C:\Windows\PFRO.log
2014-05-09 07:28 - 2009-07-13 18:34 - 69730304 _____ () C:\Windows\System32\config\SOFTWARE.bak
2014-05-09 07:28 - 2009-07-13 18:34 - 17825792 _____ () C:\Windows\System32\config\SYSTEM.bak
2014-05-09 07:28 - 2009-07-13 18:34 - 00262144 _____ () C:\Windows\System32\config\SECURITY.bak
2014-05-09 07:28 - 2009-07-13 18:34 - 00262144 _____ () C:\Windows\System32\config\SAM.bak
2014-05-09 07:28 - 2009-07-13 18:34 - 00262144 _____ () C:\Windows\System32\config\DEFAULT.bak
2014-05-09 07:28 - 2009-07-13 18:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-09 07:03 - 2013-02-04 11:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-09 07:01 - 2014-05-07 08:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-09 06:58 - 2014-05-09 06:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 06:16 - 2014-05-08 06:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-07 08:36 - 2014-05-07 08:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 08:36 - 2014-05-07 08:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 08:36 - 2013-02-04 10:56 - 00000000 ____D () C:\Users\Luke\AppData\Local\Google
2014-05-07 07:59 - 2010-03-25 12:11 - 00000000 ____D () C:\Program Files (x86)\ABBYY PDF Transformer 3.0
2014-05-07 07:45 - 2014-03-24 04:20 - 00000000 ____D () C:\Users\Luke\Desktop\Jahresbericht
2014-05-06 07:13 - 2014-05-06 07:13 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-05 06:52 - 2014-05-01 11:14 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-05 04:11 - 2013-02-11 10:08 - 00085072 _____ () C:\Users\Luke\AppData\Roaming\GDIPFONTCACHEV1.DAT
2014-05-05 04:05 - 2013-08-27 03:24 - 00000000 ____D () C:\Users\Luke\Desktop\WGL NAdine
2014-05-04 09:28 - 2009-07-13 21:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-01 23:30 - 2013-02-04 10:18 - 00085072 _____ () C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-01 23:30 - 2009-07-13 20:45 - 00360728 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-05-01 23:27 - 2010-03-25 12:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-01 23:27 - 2010-03-25 12:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-01 23:27 - 2010-03-25 12:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-01 23:27 - 2009-07-13 23:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-01 23:27 - 2009-07-13 19:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-01 11:58 - 2013-11-24 09:55 - 00000000 ____D () C:\Users\Luke\Downloads\Gameforge Live
2014-05-01 11:58 - 2013-11-24 09:55 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
2014-05-01 11:03 - 2014-05-01 11:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-30 02:59 - 2014-04-28 22:58 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 06:01 - 2014-05-03 01:47 - 23547904 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-04-29 05:40 - 2014-05-03 01:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-04-29 05:26 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF
2014-04-29 04:48 - 2014-05-03 01:47 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 04:34 - 2014-05-03 01:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-28 23:24 - 2013-12-12 09:44 - 00000000 ____D () C:\Users\Luke\Desktop\Nadine
2014-04-28 23:06 - 2014-01-01 10:19 - 00000000 ____D () C:\Users\Luke\Desktop\Samsung s3 Nadine
2014-04-28 22:58 - 2014-04-28 22:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-28 22:58 - 2014-04-28 22:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-28 22:58 - 2013-02-04 10:27 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-04-28 22:52 - 2013-06-15 07:37 - 00000000 ____D () C:\Users\Luke\Tracing
2014-04-28 09:00 - 2014-03-12 11:00 - 17931952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-28 09:00 - 2013-02-12 07:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 09:00 - 2013-02-12 07:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 09:00 - 2013-02-12 07:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-21 02:40 - 2013-04-21 11:00 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-04-21 02:40 - 2013-04-21 11:00 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-04-21 02:40 - 2013-04-21 11:00 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-04-19 00:33 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-04-18 23:36 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-18 04:38 - 2014-04-18 04:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 04:38 - 2014-04-18 04:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 04:38 - 2014-04-18 04:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 03:53 - 2014-04-18 04:37 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-13 18:24 - 2014-05-06 05:59 - 00465408 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-04-13 18:19 - 2014-05-06 05:59 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-04-18 04:38:26
Restore point made on: 2014-04-18 14:21:38
Restore point made on: 2014-04-28 10:11:45
Restore point made on: 2014-05-01 23:26:56
Restore point made on: 2014-05-03 01:47:05
Restore point made on: 2014-05-06 07:13:05
Restore point made on: 2014-05-09 07:21:08

==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 4023.11 MB
Available physical RAM: 3304.09 MB
Total Pagefile: 4021.26 MB
Available Pagefile: 3293.35 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:454.45 GB) (Free:282.32 GB) NTFS
Drive e: (DATA) (Fixed) (Total:454.96 GB) (Free:392.56 GB) NTFS
Drive f: (PQSERVICE) (Fixed) (Total:22 GB) (Free:5.22 GB) NTFS
Drive h: () (Removable) (Total:7.6 GB) (Free:7.6 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 3507A950)
Partition 1: (Not Active) - (Size=22 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=455 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 01754FBF)
Partition 1: (Active) - (Size=8 GB) - (Type=0B)


LastRegBack: 2014-05-09 08:03

==================== End Of Log ============================

--- --- ---

Grüße

Lukas

Bootsektor · 12.05.2014, 22:46

Hallo Lukas,

trenne deinen Rechner für den folgenden Fix vom Internet

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Luke\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Roaqw\rymaxsuwlk.exe [129536 2014-05-10] ()
HKU\Luke\...\RunOnce: [je1x7] - C:\ProgramData\yxjnmxu\cnkb.exe [307200 2014-05-11] (Faronics Corporation)
HKU\Luke\...\RunOnce: [yp3bg] - C:\ProgramData\qxh\beaslfh.exe [306688 2014-05-10] (Faronics Corporation)
HKU\Luke\...\RunOnce: [x7j24] - C:\ProgramData\hoqjaw\udgglt.exe [306176 2014-05-12] (Faronics Corporation)
HKU\Luke\...\RunOnce: [8tl0ou] - C:\ProgramData\fuauw\krhgelx.exe [307200 2014-05-10] (Faronics Corporation)
HKU\Luke\...\Winlogon: [Shell] C:\ProgramData\fys\vsnqpw.exe,explorer.exe <==== ATTENTION 
C:\ProgramData\lgyx
C:\ProgramData\xbq
C:\ProgramData\hoqjaw
C:\ProgramData\hcdja
C:\ProgramData\sfa
C:\ProgramData\dhcu
C:\ProgramData\yxjnmxu
C:\ProgramData\ipmftlr
C:\ProgramData\whi
C:\ProgramData\sdwvfw
C:\ProgramData\gifk
C:\ProgramData\fuauw
C:\ProgramData\fys
C:\ProgramData\xvnf
C:\ProgramData\uonhk
C:\ProgramData\qxh
C:\ProgramData\lsux
C:\Users\Luke\AppData\Roaming\Roaqw
C:\ProgramData\yywnqlx
C:\ProgramData\yxjsm
C:\ProgramData\saycy
C:\ProgramData\xvnfhl
C:\ProgramData\tjyai
C:\ProgramData\vvqacrs
C:\ProgramData\vklkphx
C:\ProgramData\mnve
C:\Users\Luke\AppData\Roaming\Inqi

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Mache danach bitte einen Scan mit FRST aus dem Normalmodus

Schritt 1
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Borse · 13.05.2014, 16:31

Hallo Sandra,

Schritt 1:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-05-2014 01
Ran by SYSTEM at 2014-05-13 17:23:23 Run:2
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Luke\...\Run: [zuaeuwlk] => C:\Users\Luke\AppData\Roaming\Roaqw\rymaxsuwlk.exe [129536 2014-05-10] ()
HKU\Luke\...\RunOnce: [je1x7] - C:\ProgramData\yxjnmxu\cnkb.exe [307200 2014-05-11] (Faronics Corporation)
HKU\Luke\...\RunOnce: [yp3bg] - C:\ProgramData\qxh\beaslfh.exe [306688 2014-05-10] (Faronics Corporation)
HKU\Luke\...\RunOnce: [x7j24] - C:\ProgramData\hoqjaw\udgglt.exe [306176 2014-05-12] (Faronics Corporation)
HKU\Luke\...\RunOnce: [8tl0ou] - C:\ProgramData\fuauw\krhgelx.exe [307200 2014-05-10] (Faronics Corporation)
HKU\Luke\...\Winlogon: [Shell] C:\ProgramData\fys\vsnqpw.exe,explorer.exe <==== ATTENTION 
C:\ProgramData\lgyx
C:\ProgramData\xbq
C:\ProgramData\hoqjaw
C:\ProgramData\hcdja
C:\ProgramData\sfa
C:\ProgramData\dhcu
C:\ProgramData\yxjnmxu
C:\ProgramData\ipmftlr
C:\ProgramData\whi
C:\ProgramData\sdwvfw
C:\ProgramData\gifk
C:\ProgramData\fuauw
C:\ProgramData\fys
C:\ProgramData\xvnf
C:\ProgramData\uonhk
C:\ProgramData\qxh
C:\ProgramData\lsux
C:\Users\Luke\AppData\Roaming\Roaqw
C:\ProgramData\yywnqlx
C:\ProgramData\yxjsm
C:\ProgramData\saycy
C:\ProgramData\xvnfhl
C:\ProgramData\tjyai
C:\ProgramData\vvqacrs
C:\ProgramData\vklkphx
C:\ProgramData\mnve
C:\Users\Luke\AppData\Roaming\Inqi
*****************

HKU\Luke\Software\Microsoft\Windows\CurrentVersion\Run\\zuaeuwlk => Value deleted successfully.
HKU\Luke\Software\Microsoft\Windows\CurrentVersion\RunOnce\\je1x7 => Value deleted successfully.
HKU\Luke\Software\Microsoft\Windows\CurrentVersion\RunOnce\\yp3bg => Value not found.
HKU\Luke\Software\Microsoft\Windows\CurrentVersion\RunOnce\\x7j24 => Value deleted successfully.
HKU\Luke\Software\Microsoft\Windows\CurrentVersion\RunOnce\\8tl0ou => Value deleted successfully.
HKU\Luke\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\ProgramData\lgyx => Moved successfully.
C:\ProgramData\xbq => Moved successfully.
C:\ProgramData\hoqjaw => Moved successfully.
C:\ProgramData\hcdja => Moved successfully.
C:\ProgramData\sfa => Moved successfully.
C:\ProgramData\dhcu => Moved successfully.
C:\ProgramData\yxjnmxu => Moved successfully.
C:\ProgramData\ipmftlr => Moved successfully.
C:\ProgramData\whi => Moved successfully.
C:\ProgramData\sdwvfw => Moved successfully.
C:\ProgramData\gifk => Moved successfully.
C:\ProgramData\fuauw => Moved successfully.
C:\ProgramData\fys => Moved successfully.
C:\ProgramData\xvnf => Moved successfully.
C:\ProgramData\uonhk => Moved successfully.
C:\ProgramData\qxh => Moved successfully.
C:\ProgramData\lsux => Moved successfully.
C:\Users\Luke\AppData\Roaming\Roaqw => Moved successfully.
C:\ProgramData\yywnqlx => Moved successfully.
C:\ProgramData\yxjsm => Moved successfully.
C:\ProgramData\saycy => Moved successfully.
C:\ProgramData\xvnfhl => Moved successfully.
C:\ProgramData\tjyai => Moved successfully.
C:\ProgramData\vvqacrs => Moved successfully.
C:\ProgramData\vklkphx => Moved successfully.
C:\ProgramData\mnve => Moved successfully.
C:\Users\Luke\AppData\Roaming\Inqi => Moved successfully.

==== End of Fixlog ====

Schritt 2:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2014 01
Ran by Luke (administrator) on LUKE-PC on 13-05-2014 17:26:56
Running from C:\Users\Luke\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(ABBYY) C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Faronics Corporation) C:\ProgramData\tob\bhpy.exe
(Faronics Corporation) C:\ProgramData\ncavnne\ovgq.exe
(Faronics Corporation) C:\ProgramData\aymukn\tpfubrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD8\PDVD8Serv.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Microsoft) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUI.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Faronics Corporation) C:\ProgramData\tob\bhpy.exe
(Faronics Corporation) C:\ProgramData\aymukn\tpfubrv.exe
(Faronics Corporation) C:\ProgramData\ncavnne\ovgq.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9608224 2009-11-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-01-06] (Apple Inc.)
HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744 2010-03-26] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [128296 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-12-22] (Acer Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-12] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] => "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-25] (Google Inc.)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [nlc36q] - C:\ProgramData\tob\bhpy.exe [306688 2014-05-12] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [jqxp] - C:\ProgramData\aymukn\tpfubrv.exe [305664 2014-05-13] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\RunOnce: [fiaumtx] - C:\ProgramData\ncavnne\ovgq.exe [305664 2014-05-13] (Faronics Corporation)
HKU\S-1-5-21-980718261-2257943446-3452172735-1000\...\Winlogon: [Shell] C:\ProgramData\rwrfjw\lbea.exe,explorer.exe <==== ATTENTION 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE522
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} -  No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Luke\AppData\Roaming\Mozilla\Firefox\Profiles\snd6g6sw.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-25] ()
R2 ABBYY.Licensing.PDFTransformer.Site License.3.0; C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968 2012-12-14] (Lavasoft Limited)
S2 AVMPowerlineService; C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe [126976 2013-11-27] (AVM GmbH)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-04] (GFI Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-13 17:24 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-13 17:24 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\mnve
2014-05-13 17:03 - 2014-05-13 17:03 - 00000000 ____D () C:\ProgramData\ibnfoqw
2014-05-13 17:03 - 2014-05-13 17:03 - 00000000 ____D () C:\ProgramData\anqye
2014-05-13 16:57 - 2014-05-13 16:58 - 00001251 _____ () C:\Users\Luke\Desktop\Fixlist.txt
2014-05-13 16:43 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\esk
2014-05-13 16:43 - 2014-05-13 16:43 - 00000000 ____D () C:\ProgramData\ncavnne
2014-05-13 16:42 - 2014-05-13 16:43 - 00000000 ____D () C:\ProgramData\hndfi
2014-05-13 16:12 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\bqxodvd
2014-05-13 16:12 - 2014-05-13 16:13 - 00000000 ____D () C:\ProgramData\dbkqsn
2014-05-13 16:12 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\aymukn
2014-05-13 16:10 - 2014-05-13 16:10 - 00000000 ____D () C:\ProgramData\rwrfjw
2014-05-12 21:58 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\oaipor
2014-05-12 21:58 - 2014-05-12 21:58 - 00000000 ____D () C:\ProgramData\tob
2014-05-12 21:58 - 2014-05-12 21:58 - 00000000 ____D () C:\ProgramData\mmqbji
2014-05-11 22:22 - 2014-05-11 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 10:36 - 2014-05-11 11:00 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-11 10:36 - 2014-05-11 10:36 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-11 10:35 - 2014-05-11 11:00 - 00000000 ____D () C:\Users\Luke\Desktop\mbar
2014-05-11 10:35 - 2014-05-11 10:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-11 10:34 - 2014-05-11 10:34 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Luke\Desktop\mbar-1.07.0.1009.exe
2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:20 - 2014-05-09 17:33 - 00000000 ____D () C:\Qoobox
2014-05-09 17:20 - 2014-05-09 17:32 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-09 17:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-09 17:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-09 17:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-08 16:15 - 2014-05-13 17:26 - 00014576 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-08 16:13 - 2014-05-13 17:26 - 00000000 ____D () C:\FRST
2014-05-08 16:12 - 2014-05-09 17:42 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:19 - 2014-05-09 17:01 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 15:59 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 15:59 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-03 11:47 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 11:47 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 11:47 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 11:47 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 21:14 - 2014-05-05 16:52 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-29 08:58 - 2014-04-30 12:59 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-19 00:22 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-19 00:22 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-19 00:22 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-19 00:22 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-19 00:22 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-19 00:22 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-19 00:22 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-19 00:22 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-19 00:22 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-19 00:22 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-19 00:22 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-19 00:22 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-19 00:22 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-19 00:22 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-19 00:22 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-19 00:22 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-19 00:22 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-19 00:22 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-19 00:22 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-19 00:22 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-19 00:22 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-19 00:22 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-19 00:22 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-19 00:22 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-19 00:22 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-19 00:22 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-19 00:22 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-19 00:21 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-19 00:21 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-19 00:21 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 14:37 - 2014-04-18 13:53 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe

==================== One Month Modified Files and Folders =======

2014-05-13 17:27 - 2014-05-08 16:15 - 00014576 _____ () C:\Users\Luke\Desktop\FRST.txt
2014-05-13 17:26 - 2014-05-08 16:13 - 00000000 ____D () C:\FRST
2014-05-13 17:25 - 2013-02-04 21:24 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-13 17:24 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\xvnfhl
2014-05-13 17:24 - 2014-05-13 17:24 - 00000000 ____D () C:\ProgramData\mnve
2014-05-13 17:24 - 2014-05-13 16:43 - 00000000 ____D () C:\ProgramData\esk
2014-05-13 17:24 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\bqxodvd
2014-05-13 17:24 - 2014-05-12 21:58 - 00000000 ____D () C:\ProgramData\oaipor
2014-05-13 17:24 - 2013-02-04 21:00 - 00001872 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-13 17:24 - 2013-02-04 21:00 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-13 17:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-13 17:24 - 2009-07-14 06:51 - 00141588 _____ () C:\Windows\setupact.log
2014-05-13 17:15 - 2013-02-04 20:10 - 01483056 _____ () C:\Windows\WindowsUpdate.log
2014-05-13 17:15 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-13 17:15 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-13 17:11 - 2013-02-04 21:00 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-13 17:03 - 2014-05-13 17:03 - 00000000 ____D () C:\ProgramData\ibnfoqw
2014-05-13 17:03 - 2014-05-13 17:03 - 00000000 ____D () C:\ProgramData\anqye
2014-05-13 17:00 - 2013-02-12 17:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-13 16:58 - 2014-05-13 16:57 - 00001251 _____ () C:\Users\Luke\Desktop\Fixlist.txt
2014-05-13 16:43 - 2014-05-13 16:43 - 00000000 ____D () C:\ProgramData\ncavnne
2014-05-13 16:43 - 2014-05-13 16:42 - 00000000 ____D () C:\ProgramData\hndfi
2014-05-13 16:19 - 2013-02-04 21:00 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-13 16:13 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\dbkqsn
2014-05-13 16:12 - 2014-05-13 16:12 - 00000000 ____D () C:\ProgramData\aymukn
2014-05-13 16:10 - 2014-05-13 16:10 - 00000000 ____D () C:\ProgramData\rwrfjw
2014-05-12 21:58 - 2014-05-12 21:58 - 00000000 ____D () C:\ProgramData\tob
2014-05-12 21:58 - 2014-05-12 21:58 - 00000000 ____D () C:\ProgramData\mmqbji
2014-05-12 16:27 - 2013-02-04 21:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-12 16:16 - 2013-02-05 04:46 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-05-12 16:16 - 2013-02-05 04:46 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-05-12 16:16 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-11 22:22 - 2014-05-11 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 11:00 - 2014-05-11 10:36 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-05-11 11:00 - 2014-05-11 10:35 - 00000000 ____D () C:\Users\Luke\Desktop\mbar
2014-05-11 10:36 - 2014-05-11 10:36 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-11 10:35 - 2014-05-11 10:35 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-11 10:34 - 2014-05-11 10:34 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Luke\Desktop\mbar-1.07.0.1009.exe
2014-05-10 10:14 - 2013-02-04 21:00 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 10:14 - 2013-02-04 21:00 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-09 17:42 - 2014-05-09 17:42 - 00000000 ____D () C:\Users\Luke\Desktop\FRST-OlderVersion
2014-05-09 17:42 - 2014-05-08 16:12 - 02064384 _____ (Farbar) C:\Users\Luke\Desktop\FRST64.exe
2014-05-09 17:39 - 2014-05-09 17:39 - 00002436 _____ () C:\Users\Luke\Desktop\FSS.txt
2014-05-09 17:38 - 2014-05-09 17:38 - 00408576 _____ (Farbar) C:\Users\Luke\Desktop\FSS.exe
2014-05-09 17:33 - 2014-05-09 17:33 - 00019543 _____ () C:\ComboFix.txt
2014-05-09 17:33 - 2014-05-09 17:20 - 00000000 ____D () C:\Qoobox
2014-05-09 17:33 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-05-09 17:32 - 2014-05-09 17:20 - 00000000 ____D () C:\Windows\erdnt
2014-05-09 17:28 - 2013-02-04 20:05 - 00867610 _____ () C:\Windows\PFRO.log
2014-05-09 17:28 - 2009-07-14 04:34 - 69730304 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 17825792 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-05-09 17:28 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-09 17:03 - 2013-02-04 21:45 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-09 17:01 - 2014-05-07 18:19 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Nico Mak Computing
2014-05-09 16:58 - 2014-05-09 16:58 - 05200039 ____R (Swearware) C:\Users\Luke\Desktop\ComboFix.exe
2014-05-08 16:16 - 2014-05-08 16:16 - 00039923 _____ () C:\Users\Luke\Desktop\Addition.txt
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieUserList
2014-05-07 18:36 - 2014-05-07 18:36 - 00000000 __SHD () C:\Users\Luke\AppData\Local\EmieSiteList
2014-05-07 18:36 - 2013-02-04 20:56 - 00000000 ____D () C:\Users\Luke\AppData\Local\Google
2014-05-07 17:59 - 2010-03-25 22:11 - 00000000 ____D () C:\Program Files (x86)\ABBYY PDF Transformer 3.0
2014-05-07 17:45 - 2014-03-24 14:20 - 00000000 ____D () C:\Users\Luke\Desktop\Jahresbericht
2014-05-06 17:13 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 16:52 - 2014-05-01 21:14 - 00014848 _____ () C:\Users\Luke\Desktop\Ausgaben Monatlich.xls
2014-05-05 14:11 - 2013-02-11 20:08 - 00085072 _____ () C:\Users\Luke\AppData\Roaming\GDIPFONTCACHEV1.DAT
2014-05-05 14:05 - 2013-08-27 13:24 - 00000000 ____D () C:\Users\Luke\Desktop\WGL NAdine
2014-05-04 19:28 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-02 23:26 - 2010-03-25 22:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-02 09:32 - 2013-02-06 21:57 - 00002715 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
2014-05-02 09:30 - 2013-02-04 20:18 - 00085072 _____ () C:\Users\Luke\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-02 09:30 - 2009-07-14 06:45 - 00360728 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-02 09:27 - 2010-03-25 22:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-02 09:27 - 2010-03-25 22:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-02 09:27 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-02 09:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Users\Luke\Downloads\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2014-05-01 21:58 - 2013-11-24 19:55 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive
2014-05-01 21:03 - 2014-05-01 21:03 - 00016384 _____ () C:\Users\Luke\Desktop\Ausgaben-_Einnahmenrechner.xls
2014-04-30 12:59 - 2014-04-29 08:58 - 00000000 ____D () C:\Users\Luke\AppData\Roaming\Skype
2014-04-29 16:01 - 2014-05-03 11:47 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 15:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-29 14:48 - 2014-05-03 11:47 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 11:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:24 - 2013-12-12 19:44 - 00000000 ____D () C:\Users\Luke\Desktop\Nadine
2014-04-29 09:06 - 2014-01-01 20:19 - 00000000 ____D () C:\Users\Luke\Desktop\Samsung s3 Nadine
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Skype
2014-04-29 08:58 - 2014-04-29 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-04-29 08:58 - 2013-02-04 20:27 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-04-29 08:52 - 2013-06-15 17:37 - 00000000 ____D () C:\Users\Luke\Tracing
2014-04-28 19:00 - 2014-03-12 21:00 - 17931952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:00 - 2013-02-12 17:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 19:00 - 2013-02-12 17:06 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-21 12:40 - 2013-04-21 21:00 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-04-21 12:40 - 2013-04-21 21:00 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-04-19 10:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-19 09:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-18 14:38 - 2014-04-18 14:38 - 00000945 _____ () C:\Users\Public\Desktop\FRITZ!Powerline.lnk
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Powerline
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files\WinPcap
2014-04-18 14:38 - 2014-04-18 14:38 - 00000000 ____D () C:\Program Files (x86)\FRITZ!Powerline
2014-04-18 13:53 - 2014-04-18 14:37 - 14944608 _____ () C:\Users\Luke\Desktop\FRITZ!Powerline_v1.0.57_DE.exe
2014-04-14 04:24 - 2014-05-06 15:59 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 15:59 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 18:03

==================== End Of Log ============================

--- --- ---

--- --- ---

Grüße

Lukas

Bootsektor · 13.05.2014, 20:44

Hallo Lukas,

da hast du dir ja etwas sehr hartnäckiges eingefangen.

Schritt 1
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Borse · 13.05.2014, 20:58

Hallo Sandra,

Ohman sowas hatte ich ja noch nie.

Code:

ATTFilter

21:53:49.0288 4876  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:53:51.0289 4876  ============================================================
21:53:51.0289 4876  Current date / time: 2014/05/13 21:53:51.0289
21:53:51.0289 4876  SystemInfo:
21:53:51.0289 4876  
21:53:51.0289 4876  OS Version: 6.1.7601 ServicePack: 1.0
21:53:51.0289 4876  Product type: Workstation
21:53:51.0290 4876  ComputerName: LUKE-PC
21:53:51.0290 4876  UserName: Luke
21:53:51.0290 4876  Windows directory: C:\Windows
21:53:51.0290 4876  System windows directory: C:\Windows
21:53:51.0290 4876  Running under WOW64
21:53:51.0290 4876  Processor architecture: Intel x64
21:53:51.0290 4876  Number of processors: 4
21:53:51.0290 4876  Page size: 0x1000
21:53:51.0290 4876  Boot type: Normal boot
21:53:51.0290 4876  ============================================================
21:53:51.0639 4876  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:53:51.0663 4876  ============================================================
21:53:51.0663 4876  \Device\Harddisk0\DR0:
21:53:51.0663 4876  MBR partitions:
21:53:51.0663 4876  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2C00800, BlocksNum 0x32000
21:53:51.0663 4876  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2C32800, BlocksNum 0x38CE7000
21:53:51.0663 4876  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x3B919800, BlocksNum 0x38DEC800
21:53:51.0663 4876  ============================================================
21:53:51.0678 4876  C: <-> \Device\Harddisk0\DR0\Partition2
21:53:51.0710 4876  D: <-> \Device\Harddisk0\DR0\Partition3
21:53:51.0710 4876  ============================================================
21:53:51.0710 4876  Initialize success
21:53:51.0710 4876  ============================================================
21:55:32.0444 7344  ============================================================
21:55:32.0444 7344  Scan started
21:55:32.0444 7344  Mode: Manual; SigCheck; TDLFS; 
21:55:32.0444 7344  ============================================================
21:55:32.0600 7344  ================ Scan system memory ========================
21:55:32.0600 7344  System memory - ok
21:55:32.0600 7344  ================ Scan services =============================
21:55:32.0772 7344  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
21:55:32.0865 7344  1394ohci - ok
21:55:32.0959 7344  [ 7EEB488346FBFA3731276C3EE8A8FD9E ] AAV UpdateService C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
21:55:32.0974 7344  AAV UpdateService - ok
21:55:33.0037 7344  [ B33CF4DE909A5B30F526D82053A63C8E ] ABBYY.Licensing.PDFTransformer.Site License.3.0 C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
21:55:33.0052 7344  ABBYY.Licensing.PDFTransformer.Site License.3.0 - ok
21:55:33.0068 7344  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
21:55:33.0084 7344  ACPI - ok
21:55:33.0099 7344  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
21:55:33.0130 7344  AcpiPmi - ok
21:55:33.0177 7344  [ A09A61CFDE15E5A67701EA812CE3F43F ] Ad-Aware Service C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
21:55:33.0208 7344  Ad-Aware Service - ok
21:55:33.0318 7344  [ 7C7E868E1D8096ED08D80FF7712BB9D8 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:55:33.0333 7344  AdobeFlashPlayerUpdateSvc - ok
21:55:33.0380 7344  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
21:55:33.0396 7344  adp94xx - ok
21:55:33.0411 7344  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
21:55:33.0427 7344  adpahci - ok
21:55:33.0442 7344  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
21:55:33.0442 7344  adpu320 - ok
21:55:33.0474 7344  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
21:55:33.0520 7344  AeLookupSvc - ok
21:55:33.0583 7344  [ 79059559E89D06E8B80CE2944BE20228 ] AFD             C:\Windows\system32\drivers\afd.sys
21:55:33.0645 7344  AFD - ok
21:55:33.0676 7344  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
21:55:33.0692 7344  agp440 - ok
21:55:33.0708 7344  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe
21:55:33.0739 7344  ALG - ok
21:55:33.0770 7344  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
21:55:33.0786 7344  aliide - ok
21:55:33.0817 7344  [ 8F6C0FF277DBFE5EBED24E3543DA7BFA ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
21:55:33.0848 7344  AMD External Events Utility - ok
21:55:33.0864 7344  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
21:55:33.0864 7344  amdide - ok
21:55:33.0895 7344  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
21:55:33.0910 7344  AmdK8 - ok
21:55:34.0035 7344  [ 9673319070166E26660EBA4EDF316FA2 ] amdkmdag        C:\Windows\system32\DRIVERS\atipmdag.sys
21:55:34.0207 7344  amdkmdag - ok
21:55:34.0238 7344  [ 430D06D63952848E64CBBF23B5C1479E ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
21:55:34.0285 7344  amdkmdap - ok
21:55:34.0300 7344  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
21:55:34.0332 7344  AmdPPM - ok
21:55:34.0347 7344  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
21:55:34.0363 7344  amdsata - ok
21:55:34.0378 7344  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
21:55:34.0394 7344  amdsbs - ok
21:55:34.0410 7344  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
21:55:34.0425 7344  amdxata - ok
21:55:34.0441 7344  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys
21:55:34.0503 7344  AppID - ok
21:55:34.0519 7344  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
21:55:34.0581 7344  AppIDSvc - ok
21:55:34.0628 7344  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo         C:\Windows\System32\appinfo.dll
21:55:34.0675 7344  Appinfo - ok
21:55:34.0722 7344  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys
21:55:34.0737 7344  arc - ok
21:55:34.0753 7344  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
21:55:34.0768 7344  arcsas - ok
21:55:34.0862 7344  [ 9A262EDD17F8473B91B333D6B031A901 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:55:34.0878 7344  aspnet_state - ok
21:55:34.0893 7344  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
21:55:34.0940 7344  AsyncMac - ok
21:55:34.0987 7344  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys
21:55:35.0002 7344  atapi - ok
21:55:35.0034 7344  [ FB7602C5C508BE281368AAE0B61B51C6 ] AtiHdmiService  C:\Windows\system32\drivers\AtiHdmi.sys
21:55:35.0065 7344  AtiHdmiService - ok
21:55:35.0112 7344  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
21:55:35.0158 7344  AudioEndpointBuilder - ok
21:55:35.0174 7344  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
21:55:35.0205 7344  AudioSrv - ok
21:55:35.0283 7344  [ 205955CA49FFEFD9BE5D3B6463E03A99 ] AVMPowerlineService C:\Program Files (x86)\FRITZ!Powerline\PowerlineService.exe
21:55:35.0299 7344  AVMPowerlineService ( UnsignedFile.Multi.Generic ) - warning
21:55:35.0299 7344  AVMPowerlineService - detected UnsignedFile.Multi.Generic (1)
21:55:35.0330 7344  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
21:55:35.0361 7344  AxInstSV - ok
21:55:35.0408 7344  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
21:55:35.0455 7344  b06bdrv - ok
21:55:35.0486 7344  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
21:55:35.0533 7344  b57nd60a - ok
21:55:35.0564 7344  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
21:55:35.0580 7344  BDESVC - ok
21:55:35.0626 7344  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
21:55:35.0673 7344  Beep - ok
21:55:35.0720 7344  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll
21:55:35.0767 7344  BFE - ok
21:55:35.0798 7344  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\system32\qmgr.dll
21:55:35.0860 7344  BITS - ok
21:55:35.0876 7344  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
21:55:35.0892 7344  blbdrive - ok
21:55:35.0923 7344  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
21:55:35.0938 7344  bowser - ok
21:55:35.0954 7344  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:55:36.0001 7344  BrFiltLo - ok
21:55:36.0016 7344  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:55:36.0032 7344  BrFiltUp - ok
21:55:36.0063 7344  [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
21:55:36.0110 7344  BridgeMP - ok
21:55:36.0141 7344  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll
21:55:36.0157 7344  Browser - ok
21:55:36.0172 7344  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
21:55:36.0188 7344  Brserid - ok
21:55:36.0188 7344  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
21:55:36.0219 7344  BrSerWdm - ok
21:55:36.0235 7344  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
21:55:36.0266 7344  BrUsbMdm - ok
21:55:36.0282 7344  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
21:55:36.0282 7344  BrUsbSer - ok
21:55:36.0297 7344  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
21:55:36.0313 7344  BTHMODEM - ok
21:55:36.0344 7344  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll
21:55:36.0406 7344  bthserv - ok
21:55:36.0422 7344  catchme - ok
21:55:36.0438 7344  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
21:55:36.0484 7344  cdfs - ok
21:55:36.0516 7344  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\drivers\cdrom.sys
21:55:36.0547 7344  cdrom - ok
21:55:36.0594 7344  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll
21:55:36.0640 7344  CertPropSvc - ok
21:55:36.0656 7344  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
21:55:36.0687 7344  circlass - ok
21:55:36.0718 7344  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
21:55:36.0734 7344  CLFS - ok
21:55:36.0812 7344  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:55:36.0828 7344  clr_optimization_v2.0.50727_32 - ok
21:55:36.0859 7344  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:55:36.0874 7344  clr_optimization_v2.0.50727_64 - ok
21:55:36.0937 7344  [ E87213F37A13E2B54391E40934F071D0 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:55:36.0952 7344  clr_optimization_v4.0.30319_32 - ok
21:55:36.0984 7344  [ 4AEDAB50F83580D0B4D6CF78191F92AA ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:55:37.0015 7344  clr_optimization_v4.0.30319_64 - ok
21:55:37.0046 7344  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
21:55:37.0062 7344  CmBatt - ok
21:55:37.0093 7344  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
21:55:37.0093 7344  cmdide - ok
21:55:37.0140 7344  [ EBF28856F69CF094A902F884CF989706 ] CNG             C:\Windows\system32\Drivers\cng.sys
21:55:37.0171 7344  CNG - ok
21:55:37.0171 7344  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
21:55:37.0186 7344  Compbatt - ok
21:55:37.0218 7344  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
21:55:37.0264 7344  CompositeBus - ok
21:55:37.0280 7344  COMSysApp - ok
21:55:37.0280 7344  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
21:55:37.0280 7344  crcdisk - ok
21:55:37.0327 7344  [ 6B400F211BEE880A37A1ED0368776BF4 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
21:55:37.0327 7344  CryptSvc - ok
21:55:37.0358 7344  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
21:55:37.0420 7344  DcomLaunch - ok
21:55:37.0436 7344  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll
21:55:37.0483 7344  defragsvc - ok
21:55:37.0530 7344  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
21:55:37.0576 7344  DfsC - ok
21:55:37.0623 7344  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
21:55:37.0670 7344  Dhcp - ok
21:55:37.0686 7344  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
21:55:37.0717 7344  discache - ok
21:55:37.0748 7344  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
21:55:37.0748 7344  Disk - ok
21:55:37.0779 7344  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
21:55:37.0826 7344  Dnscache - ok
21:55:37.0842 7344  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll
21:55:37.0873 7344  dot3svc - ok
21:55:37.0904 7344  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll
21:55:37.0951 7344  DPS - ok
21:55:37.0998 7344  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
21:55:38.0029 7344  drmkaud - ok
21:55:38.0076 7344  [ 88612F1CE3BF42256913BF6E61C70D52 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
21:55:38.0107 7344  DXGKrnl - ok
21:55:38.0122 7344  EagleX64 - ok
21:55:38.0154 7344  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll
21:55:38.0200 7344  EapHost - ok
21:55:38.0263 7344  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
21:55:38.0372 7344  ebdrv - ok
21:55:38.0403 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] EFS             C:\Windows\System32\lsass.exe
21:55:38.0434 7344  EFS - ok
21:55:38.0481 7344  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
21:55:38.0544 7344  ehRecvr - ok
21:55:38.0575 7344  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe
21:55:38.0590 7344  ehSched - ok
21:55:38.0637 7344  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
21:55:38.0653 7344  elxstor - ok
21:55:38.0668 7344  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
21:55:38.0700 7344  ErrDev - ok
21:55:38.0731 7344  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll
21:55:38.0778 7344  EventSystem - ok
21:55:38.0809 7344  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys
21:55:38.0856 7344  exfat - ok
21:55:38.0871 7344  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys
21:55:38.0918 7344  fastfat - ok
21:55:38.0934 7344  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe
21:55:38.0965 7344  Fax - ok
21:55:38.0980 7344  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
21:55:38.0996 7344  fdc - ok
21:55:38.0996 7344  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll
21:55:39.0043 7344  fdPHost - ok
21:55:39.0058 7344  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
21:55:39.0090 7344  FDResPub - ok
21:55:39.0105 7344  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
21:55:39.0121 7344  FileInfo - ok
21:55:39.0121 7344  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
21:55:39.0168 7344  Filetrace - ok
21:55:39.0199 7344  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
21:55:39.0199 7344  flpydisk - ok
21:55:39.0246 7344  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
21:55:39.0261 7344  FltMgr - ok
21:55:39.0324 7344  [ C4C183E6551084039EC862DA1C945E3D ] FontCache       C:\Windows\system32\FntCache.dll
21:55:39.0355 7344  FontCache - ok
21:55:39.0417 7344  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:55:39.0433 7344  FontCache3.0.0.0 - ok
21:55:39.0448 7344  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
21:55:39.0464 7344  FsDepends - ok
21:55:39.0480 7344  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
21:55:39.0495 7344  Fs_Rec - ok
21:55:39.0526 7344  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
21:55:39.0542 7344  fvevol - ok
21:55:39.0542 7344  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
21:55:39.0558 7344  gagp30kx - ok
21:55:39.0589 7344  [ 14908F4F9005C29DE8F5587E271390EE ] gfibto          C:\Windows\system32\drivers\gfibto.sys
21:55:39.0604 7344  gfibto - ok
21:55:39.0636 7344  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll
21:55:39.0698 7344  gpsvc - ok
21:55:39.0776 7344  [ 816FD5A6F3C2F3D600900096632FC60E ] Greg_Service    C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
21:55:39.0807 7344  Greg_Service - ok
21:55:39.0870 7344  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:55:39.0885 7344  gupdate - ok
21:55:39.0885 7344  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:55:39.0901 7344  gupdatem - ok
21:55:39.0916 7344  [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:55:39.0932 7344  gusvc - ok
21:55:39.0979 7344  [ 6D0F56D217545E2D0ADDBF301B35260F ] HCW85BDA        C:\Windows\system32\drivers\HCW85BDA.sys
21:55:40.0041 7344  HCW85BDA - ok
21:55:40.0072 7344  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
21:55:40.0104 7344  hcw85cir - ok
21:55:40.0135 7344  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
21:55:40.0166 7344  HdAudAddService - ok
21:55:40.0197 7344  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
21:55:40.0228 7344  HDAudBus - ok
21:55:40.0228 7344  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
21:55:40.0244 7344  HidBatt - ok
21:55:40.0275 7344  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
21:55:40.0306 7344  HidBth - ok
21:55:40.0322 7344  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
21:55:40.0338 7344  HidIr - ok
21:55:40.0369 7344  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\System32\hidserv.dll
21:55:40.0416 7344  hidserv - ok
21:55:40.0447 7344  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
21:55:40.0462 7344  HidUsb - ok
21:55:40.0478 7344  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
21:55:40.0525 7344  hkmsvc - ok
21:55:40.0556 7344  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
21:55:40.0587 7344  HomeGroupListener - ok
21:55:40.0603 7344  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
21:55:40.0634 7344  HomeGroupProvider - ok
21:55:40.0650 7344  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
21:55:40.0665 7344  HpSAMD - ok
21:55:40.0712 7344  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
21:55:40.0759 7344  HTTP - ok
21:55:40.0790 7344  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
21:55:40.0806 7344  hwpolicy - ok
21:55:40.0821 7344  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
21:55:40.0821 7344  i8042prt - ok
21:55:40.0868 7344  [ 631FA8935163B01FC0C02966CB3ADB92 ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
21:55:40.0899 7344  iaStor - ok
21:55:40.0915 7344  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
21:55:40.0930 7344  iaStorV - ok
21:55:40.0962 7344  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:55:40.0993 7344  idsvc - ok
21:55:41.0024 7344  IEEtwCollectorService - ok
21:55:41.0055 7344  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
21:55:41.0086 7344  iirsp - ok
21:55:41.0118 7344  [ 344789398EC3EE5A4E00C52B31847946 ] IKEEXT          C:\Windows\System32\ikeext.dll
21:55:41.0149 7344  IKEEXT - ok
21:55:41.0211 7344  [ 52D9171838BB92319F23656F502916E9 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
21:55:41.0258 7344  IntcAzAudAddService - ok
21:55:41.0274 7344  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
21:55:41.0289 7344  intelide - ok
21:55:41.0305 7344  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
21:55:41.0320 7344  intelppm - ok
21:55:41.0352 7344  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
21:55:41.0398 7344  IPBusEnum - ok
21:55:41.0430 7344  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:55:41.0476 7344  IpFilterDriver - ok
21:55:41.0508 7344  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
21:55:41.0539 7344  iphlpsvc - ok
21:55:41.0570 7344  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
21:55:41.0586 7344  IPMIDRV - ok
21:55:41.0601 7344  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
21:55:41.0648 7344  IPNAT - ok
21:55:41.0664 7344  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
21:55:41.0679 7344  IRENUM - ok
21:55:41.0695 7344  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
21:55:41.0710 7344  isapnp - ok
21:55:41.0742 7344  [ 96BB922A0981BC7432C8CF52B5410FE6 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
21:55:41.0757 7344  iScsiPrt - ok
21:55:41.0773 7344  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
21:55:41.0788 7344  kbdclass - ok
21:55:41.0804 7344  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
21:55:41.0835 7344  kbdhid - ok
21:55:41.0851 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] KeyIso          C:\Windows\system32\lsass.exe
21:55:41.0851 7344  KeyIso - ok
21:55:41.0882 7344  [ 8F489706472F7E9A06BAAA198703FA64 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
21:55:41.0898 7344  KSecDD - ok
21:55:41.0898 7344  [ 868A2CAAB12EFC7A021682BCA0EEC54C ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
21:55:41.0913 7344  KSecPkg - ok
21:55:41.0913 7344  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
21:55:41.0960 7344  ksthunk - ok
21:55:42.0007 7344  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll
21:55:42.0038 7344  KtmRm - ok
21:55:42.0069 7344  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\System32\srvsvc.dll
21:55:42.0100 7344  LanmanServer - ok
21:55:42.0116 7344  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
21:55:42.0147 7344  LanmanWorkstation - ok
21:55:42.0163 7344  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
21:55:42.0210 7344  lltdio - ok
21:55:42.0241 7344  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
21:55:42.0288 7344  lltdsvc - ok
21:55:42.0303 7344  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll
21:55:42.0334 7344  lmhosts - ok
21:55:42.0366 7344  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
21:55:42.0381 7344  LSI_FC - ok
21:55:42.0381 7344  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
21:55:42.0397 7344  LSI_SAS - ok
21:55:42.0397 7344  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:55:42.0397 7344  LSI_SAS2 - ok
21:55:42.0412 7344  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:55:42.0428 7344  LSI_SCSI - ok
21:55:42.0444 7344  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys
21:55:42.0490 7344  luafv - ok
21:55:42.0537 7344  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
21:55:42.0553 7344  Mcx2Svc - ok
21:55:42.0568 7344  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
21:55:42.0584 7344  megasas - ok
21:55:42.0600 7344  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
21:55:42.0615 7344  MegaSR - ok
21:55:42.0646 7344  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll
21:55:42.0678 7344  MMCSS - ok
21:55:42.0709 7344  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys
21:55:42.0756 7344  Modem - ok
21:55:42.0771 7344  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
21:55:42.0787 7344  monitor - ok
21:55:42.0834 7344  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
21:55:42.0834 7344  mouclass - ok
21:55:42.0865 7344  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
21:55:42.0880 7344  mouhid - ok
21:55:42.0927 7344  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
21:55:42.0943 7344  mountmgr - ok
21:55:42.0974 7344  [ E1B6FCAE82474FC071155263E2841D54 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:55:42.0990 7344  MozillaMaintenance - ok
21:55:43.0005 7344  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
21:55:43.0021 7344  mpio - ok
21:55:43.0036 7344  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
21:55:43.0083 7344  mpsdrv - ok
21:55:43.0114 7344  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
21:55:43.0192 7344  MpsSvc - ok
21:55:43.0224 7344  [ 1A4F75E63C9FB84B85DFFC6B63FD5404 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
21:55:43.0239 7344  MRxDAV - ok
21:55:43.0270 7344  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
21:55:43.0302 7344  mrxsmb - ok
21:55:43.0317 7344  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:55:43.0333 7344  mrxsmb10 - ok
21:55:43.0348 7344  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:55:43.0364 7344  mrxsmb20 - ok
21:55:43.0395 7344  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
21:55:43.0411 7344  msahci - ok
21:55:43.0426 7344  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
21:55:43.0426 7344  msdsm - ok
21:55:43.0442 7344  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe
21:55:43.0489 7344  MSDTC - ok
21:55:43.0536 7344  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
21:55:43.0582 7344  Msfs - ok
21:55:43.0582 7344  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
21:55:43.0629 7344  mshidkmdf - ok
21:55:43.0645 7344  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
21:55:43.0660 7344  msisadrv - ok
21:55:43.0707 7344  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
21:55:43.0738 7344  MSiSCSI - ok
21:55:43.0738 7344  msiserver - ok
21:55:43.0754 7344  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
21:55:43.0801 7344  MSKSSRV - ok
21:55:43.0816 7344  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
21:55:43.0848 7344  MSPCLOCK - ok
21:55:43.0848 7344  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
21:55:43.0894 7344  MSPQM - ok
21:55:43.0910 7344  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
21:55:43.0926 7344  MsRPC - ok
21:55:43.0941 7344  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
21:55:43.0957 7344  mssmbios - ok
21:55:43.0957 7344  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
21:55:43.0988 7344  MSTEE - ok
21:55:44.0004 7344  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
21:55:44.0019 7344  MTConfig - ok
21:55:44.0035 7344  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys
21:55:44.0050 7344  Mup - ok
21:55:44.0082 7344  [ 6FFECC25B39DC7652A0CEC0ADA9DB589 ] mwlPSDFilter    C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
21:55:44.0097 7344  mwlPSDFilter - ok
21:55:44.0097 7344  [ 0BEFE32CA56D6EE89D58175725596A85 ] mwlPSDNServ     C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
21:55:44.0113 7344  mwlPSDNServ - ok
21:55:44.0113 7344  [ D43BC633B8660463E446E28E14A51262 ] mwlPSDVDisk     C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
21:55:44.0128 7344  mwlPSDVDisk - ok
21:55:44.0160 7344  [ 2F139207F618EC2933830227EEFFDDB4 ] MWLService      C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
21:55:44.0175 7344  MWLService - ok
21:55:44.0222 7344  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
21:55:44.0269 7344  napagent - ok
21:55:44.0300 7344  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
21:55:44.0331 7344  NativeWifiP - ok
21:55:44.0378 7344  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
21:55:44.0409 7344  NDIS - ok
21:55:44.0440 7344  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
21:55:44.0472 7344  NdisCap - ok
21:55:44.0503 7344  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
21:55:44.0550 7344  NdisTapi - ok
21:55:44.0581 7344  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
21:55:44.0643 7344  Ndisuio - ok
21:55:44.0674 7344  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
21:55:44.0706 7344  NdisWan - ok
21:55:44.0737 7344  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
21:55:44.0768 7344  NDProxy - ok
21:55:44.0862 7344  [ 7D2633295EB6FF2B938185874884059D ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
21:55:44.0893 7344  Nero BackItUp Scheduler 4.0 - ok
21:55:44.0893 7344  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
21:55:44.0955 7344  NetBIOS - ok
21:55:44.0986 7344  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
21:55:45.0033 7344  NetBT - ok
21:55:45.0049 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] Netlogon        C:\Windows\system32\lsass.exe
21:55:45.0049 7344  Netlogon - ok
21:55:45.0080 7344  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
21:55:45.0142 7344  Netman - ok
21:55:45.0174 7344  [ 21318671BCAD3ACF16638F98D4D00973 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:45.0189 7344  NetMsmqActivator - ok
21:55:45.0205 7344  [ 21318671BCAD3ACF16638F98D4D00973 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:45.0220 7344  NetPipeActivator - ok
21:55:45.0236 7344  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
21:55:45.0283 7344  netprofm - ok
21:55:45.0314 7344  [ 21318671BCAD3ACF16638F98D4D00973 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:45.0314 7344  NetTcpActivator - ok
21:55:45.0330 7344  [ 21318671BCAD3ACF16638F98D4D00973 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:45.0330 7344  NetTcpPortSharing - ok
21:55:45.0361 7344  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
21:55:45.0376 7344  nfrd960 - ok
21:55:45.0408 7344  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
21:55:45.0439 7344  NlaSvc - ok
21:55:45.0454 7344  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
21:55:45.0486 7344  Npfs - ok
21:55:45.0501 7344  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll
21:55:45.0548 7344  nsi - ok
21:55:45.0564 7344  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
21:55:45.0610 7344  nsiproxy - ok
21:55:45.0657 7344  [ 1A29A59A4C5BA6F8C85062A613B7E2B2 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
21:55:45.0704 7344  Ntfs - ok
21:55:45.0704 7344  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
21:55:45.0735 7344  Null - ok
21:55:45.0766 7344  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
21:55:45.0782 7344  nvraid - ok
21:55:45.0798 7344  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
21:55:45.0798 7344  nvstor - ok
21:55:45.0813 7344  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
21:55:45.0813 7344  nv_agp - ok
21:55:45.0829 7344  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
21:55:45.0844 7344  ohci1394 - ok
21:55:45.0907 7344  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:55:45.0922 7344  ose - ok
21:55:45.0938 7344  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
21:55:45.0969 7344  p2pimsvc - ok
21:55:45.0985 7344  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
21:55:46.0000 7344  p2psvc - ok
21:55:46.0032 7344  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
21:55:46.0032 7344  Parport - ok
21:55:46.0063 7344  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys
21:55:46.0078 7344  partmgr - ok
21:55:46.0078 7344  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
21:55:46.0110 7344  PcaSvc - ok
21:55:46.0125 7344  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys
21:55:46.0141 7344  pci - ok
21:55:46.0172 7344  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
21:55:46.0172 7344  pciide - ok
21:55:46.0188 7344  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
21:55:46.0203 7344  pcmcia - ok
21:55:46.0219 7344  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys
21:55:46.0219 7344  pcw - ok
21:55:46.0250 7344  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
21:55:46.0297 7344  PEAUTH - ok
21:55:46.0375 7344  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
21:55:46.0390 7344  PerfHost - ok
21:55:46.0453 7344  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll
21:55:46.0500 7344  pla - ok
21:55:46.0546 7344  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
21:55:46.0578 7344  PlugPlay - ok
21:55:46.0609 7344  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
21:55:46.0640 7344  PNRPAutoReg - ok
21:55:46.0656 7344  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
21:55:46.0671 7344  PNRPsvc - ok
21:55:46.0702 7344  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
21:55:46.0749 7344  PolicyAgent - ok
21:55:46.0765 7344  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll
21:55:46.0812 7344  Power - ok
21:55:46.0858 7344  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
21:55:46.0890 7344  PptpMiniport - ok
21:55:46.0936 7344  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys
21:55:46.0968 7344  Processor - ok
21:55:46.0999 7344  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll
21:55:47.0030 7344  ProfSvc - ok
21:55:47.0046 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] ProtectedStorage C:\Windows\system32\lsass.exe
21:55:47.0061 7344  ProtectedStorage - ok
21:55:47.0092 7344  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
21:55:47.0155 7344  Psched - ok
21:55:47.0186 7344  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
21:55:47.0217 7344  ql2300 - ok
21:55:47.0233 7344  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
21:55:47.0233 7344  ql40xx - ok
21:55:47.0248 7344  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll
21:55:47.0264 7344  QWAVE - ok
21:55:47.0280 7344  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
21:55:47.0311 7344  QWAVEdrv - ok
21:55:47.0326 7344  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
21:55:47.0358 7344  RasAcd - ok
21:55:47.0389 7344  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
21:55:47.0451 7344  RasAgileVpn - ok
21:55:47.0451 7344  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll
21:55:47.0498 7344  RasAuto - ok
21:55:47.0529 7344  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
21:55:47.0576 7344  Rasl2tp - ok
21:55:47.0607 7344  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
21:55:47.0670 7344  RasMan - ok
21:55:47.0670 7344  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
21:55:47.0732 7344  RasPppoe - ok
21:55:47.0748 7344  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
21:55:47.0794 7344  RasSstp - ok
21:55:47.0810 7344  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
21:55:47.0872 7344  rdbss - ok
21:55:47.0888 7344  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
21:55:47.0904 7344  rdpbus - ok
21:55:47.0919 7344  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
21:55:47.0966 7344  RDPCDD - ok
21:55:47.0982 7344  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
21:55:48.0013 7344  RDPENCDD - ok
21:55:48.0028 7344  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
21:55:48.0060 7344  RDPREFMP - ok
21:55:48.0091 7344  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
21:55:48.0122 7344  RDPWD - ok
21:55:48.0153 7344  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
21:55:48.0184 7344  rdyboost - ok
21:55:48.0200 7344  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
21:55:48.0247 7344  RemoteAccess - ok
21:55:48.0278 7344  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
21:55:48.0325 7344  RemoteRegistry - ok
21:55:48.0325 7344  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
21:55:48.0372 7344  RpcEptMapper - ok
21:55:48.0387 7344  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
21:55:48.0403 7344  RpcLocator - ok
21:55:48.0434 7344  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll
21:55:48.0465 7344  RpcSs - ok
21:55:48.0481 7344  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
21:55:48.0512 7344  rspndr - ok
21:55:48.0559 7344  [ 365ED58B47B46DE8B1C5FA759B6FCD6E ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
21:55:48.0590 7344  RTL8167 - ok
21:55:48.0606 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] SamSs           C:\Windows\system32\lsass.exe
21:55:48.0606 7344  SamSs - ok
21:55:48.0715 7344  [ 99FC1599F89A80216E41175B8CA44D89 ] SBAMSvc         C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
21:55:48.0855 7344  SBAMSvc - ok
21:55:48.0902 7344  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
21:55:48.0918 7344  sbp2port - ok
21:55:48.0933 7344  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
21:55:48.0964 7344  SCardSvr - ok
21:55:48.0996 7344  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
21:55:49.0042 7344  scfilter - ok
21:55:49.0074 7344  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
21:55:49.0120 7344  Schedule - ok
21:55:49.0152 7344  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll
21:55:49.0183 7344  SCPolicySvc - ok
21:55:49.0198 7344  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
21:55:49.0230 7344  SDRSVC - ok
21:55:49.0261 7344  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
21:55:49.0323 7344  secdrv - ok
21:55:49.0339 7344  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
21:55:49.0401 7344  seclogon - ok
21:55:49.0417 7344  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\system32\sens.dll
21:55:49.0479 7344  SENS - ok
21:55:49.0495 7344  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
21:55:49.0526 7344  SensrSvc - ok
21:55:49.0542 7344  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
21:55:49.0557 7344  Serenum - ok
21:55:49.0573 7344  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
21:55:49.0588 7344  Serial - ok
21:55:49.0620 7344  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
21:55:49.0635 7344  sermouse - ok
21:55:49.0666 7344  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
21:55:49.0713 7344  SessionEnv - ok
21:55:49.0744 7344  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
21:55:49.0776 7344  sffdisk - ok
21:55:49.0776 7344  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
21:55:49.0791 7344  sffp_mmc - ok
21:55:49.0791 7344  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
21:55:49.0822 7344  sffp_sd - ok
21:55:49.0822 7344  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
21:55:49.0838 7344  sfloppy - ok
21:55:49.0885 7344  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
21:55:49.0932 7344  SharedAccess - ok
21:55:49.0963 7344  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
21:55:49.0994 7344  ShellHWDetection - ok
21:55:50.0010 7344  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:55:50.0025 7344  SiSRaid2 - ok
21:55:50.0025 7344  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
21:55:50.0041 7344  SiSRaid4 - ok
21:55:50.0088 7344  [ 875B04A71869D34A415CC8B4D4673EC4 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
21:55:50.0103 7344  SkypeUpdate - ok
21:55:50.0103 7344  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
21:55:50.0150 7344  Smb - ok
21:55:50.0181 7344  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
21:55:50.0212 7344  SNMPTRAP - ok
21:55:50.0228 7344  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys
21:55:50.0228 7344  spldr - ok
21:55:50.0259 7344  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe
21:55:50.0290 7344  Spooler - ok
21:55:50.0368 7344  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
21:55:50.0509 7344  sppsvc - ok
21:55:50.0524 7344  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
21:55:50.0571 7344  sppuinotify - ok
21:55:50.0602 7344  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys
21:55:50.0634 7344  srv - ok
21:55:50.0665 7344  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
21:55:50.0680 7344  srv2 - ok
21:55:50.0712 7344  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
21:55:50.0712 7344  srvnet - ok
21:55:50.0743 7344  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
21:55:50.0790 7344  SSDPSRV - ok
21:55:50.0805 7344  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll
21:55:50.0836 7344  SstpSvc - ok
21:55:50.0883 7344  [ 706080AD43599D4AB04F1676A3A62CC1 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
21:55:51.0024 7344  Steam Client Service - ok
21:55:51.0055 7344  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
21:55:51.0070 7344  stexstor - ok
21:55:51.0102 7344  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
21:55:51.0148 7344  stisvc - ok
21:55:51.0180 7344  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
21:55:51.0180 7344  swenum - ok
21:55:51.0195 7344  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll
21:55:51.0258 7344  swprv - ok
21:55:51.0304 7344  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll
21:55:51.0398 7344  SysMain - ok
21:55:51.0429 7344  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
21:55:51.0460 7344  TabletInputService - ok
21:55:51.0476 7344  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll
21:55:51.0523 7344  TapiSrv - ok
21:55:51.0554 7344  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll
21:55:51.0601 7344  TBS - ok
21:55:51.0663 7344  [ 40AF23633D197905F03AB5628C558C51 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
21:55:51.0741 7344  Tcpip - ok
21:55:51.0772 7344  [ 40AF23633D197905F03AB5628C558C51 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
21:55:51.0804 7344  TCPIP6 - ok
21:55:51.0835 7344  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
21:55:51.0866 7344  tcpipreg - ok
21:55:51.0882 7344  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
21:55:51.0913 7344  TDPIPE - ok
21:55:51.0928 7344  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
21:55:51.0944 7344  TDTCP - ok
21:55:51.0975 7344  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
21:55:52.0022 7344  tdx - ok
21:55:52.0053 7344  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
21:55:52.0069 7344  TermDD - ok
21:55:52.0116 7344  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll
21:55:52.0162 7344  TermService - ok
21:55:52.0178 7344  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
21:55:52.0194 7344  Themes - ok
21:55:52.0240 7344  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll
21:55:52.0287 7344  THREADORDER - ok
21:55:52.0287 7344  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
21:55:52.0334 7344  TrkWks - ok
21:55:52.0381 7344  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
21:55:52.0412 7344  TrustedInstaller - ok
21:55:52.0459 7344  [ 4CE278FC9671BA81A138D70823FCAA09 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
21:55:52.0490 7344  tssecsrv - ok
21:55:52.0537 7344  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
21:55:52.0568 7344  TsUsbFlt - ok
21:55:52.0615 7344  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
21:55:52.0677 7344  tunnel - ok
21:55:52.0693 7344  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
21:55:52.0708 7344  uagp35 - ok
21:55:52.0740 7344  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
21:55:52.0786 7344  udfs - ok
21:55:52.0802 7344  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
21:55:52.0818 7344  UI0Detect - ok
21:55:52.0833 7344  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
21:55:52.0849 7344  uliagpkx - ok
21:55:52.0864 7344  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\drivers\umbus.sys
21:55:52.0896 7344  umbus - ok
21:55:52.0911 7344  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
21:55:52.0927 7344  UmPass - ok
21:55:52.0989 7344  [ 70DDE3A86DBEB1D6C3C30AD687B1877A ] Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
21:55:53.0005 7344  Updater Service - ok
21:55:53.0036 7344  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
21:55:53.0083 7344  upnphost - ok
21:55:53.0098 7344  [ DCA68B0943D6FA415F0C56C92158A83A ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
21:55:53.0114 7344  usbccgp - ok
21:55:53.0145 7344  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
21:55:53.0161 7344  usbcir - ok
21:55:53.0176 7344  [ 18A85013A3E0F7E1755365D287443965 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
21:55:53.0192 7344  usbehci - ok
21:55:53.0208 7344  [ 8D1196CFBB223621F2C67D45710F25BA ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
21:55:53.0239 7344  usbhub - ok
21:55:53.0254 7344  [ 765A92D428A8DB88B960DA5A8D6089DC ] usbohci         C:\Windows\system32\drivers\usbohci.sys
21:55:53.0286 7344  usbohci - ok
21:55:53.0301 7344  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
21:55:53.0332 7344  usbprint - ok
21:55:53.0348 7344  [ 9661DA76B4531B2DA272ECCE25A8AF24 ] usbscan         C:\Windows\system32\drivers\usbscan.sys
21:55:53.0379 7344  usbscan - ok
21:55:53.0395 7344  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:55:53.0410 7344  USBSTOR - ok
21:55:53.0442 7344  [ DD253AFC3BC6CBA412342DE60C3647F3 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
21:55:53.0442 7344  usbuhci - ok
21:55:53.0473 7344  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll
21:55:53.0504 7344  UxSms - ok
21:55:53.0520 7344  [ 4D71227301DD8D09097B9E4CC6527E5A ] VaultSvc        C:\Windows\system32\lsass.exe
21:55:53.0535 7344  VaultSvc - ok
21:55:53.0551 7344  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
21:55:53.0566 7344  vdrvroot - ok
21:55:53.0598 7344  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe
21:55:53.0644 7344  vds - ok
21:55:53.0660 7344  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
21:55:53.0660 7344  vga - ok
21:55:53.0676 7344  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys
21:55:53.0722 7344  VgaSave - ok
21:55:53.0754 7344  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
21:55:53.0754 7344  vhdmp - ok
21:55:53.0785 7344  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
21:55:53.0785 7344  viaide - ok
21:55:53.0816 7344  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
21:55:53.0816 7344  volmgr - ok
21:55:53.0863 7344  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
21:55:53.0878 7344  volmgrx - ok
21:55:53.0910 7344  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
21:55:53.0910 7344  volsnap - ok
21:55:53.0925 7344  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
21:55:53.0941 7344  vsmraid - ok
21:55:53.0988 7344  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe
21:55:54.0050 7344  VSS - ok
21:55:54.0066 7344  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
21:55:54.0081 7344  vwifibus - ok
21:55:54.0112 7344  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll
21:55:54.0159 7344  W32Time - ok
21:55:54.0159 7344  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
21:55:54.0190 7344  WacomPen - ok
21:55:54.0206 7344  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
21:55:54.0268 7344  WANARP - ok
21:55:54.0284 7344  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
21:55:54.0315 7344  Wanarpv6 - ok
21:55:54.0362 7344  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
21:55:54.0393 7344  wbengine - ok
21:55:54.0393 7344  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
21:55:54.0409 7344  WbioSrvc - ok
21:55:54.0440 7344  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll
21:55:54.0456 7344  wcncsvc - ok
21:55:54.0471 7344  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
21:55:54.0487 7344  WcsPlugInService - ok
21:55:54.0487 7344  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
21:55:54.0502 7344  Wd - ok
21:55:54.0534 7344  [ E2C933EDBC389386EBE6D2BA953F43D8 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
21:55:54.0549 7344  Wdf01000 - ok
21:55:54.0565 7344  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
21:55:54.0596 7344  WdiServiceHost - ok
21:55:54.0596 7344  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll
21:55:54.0612 7344  WdiSystemHost - ok
21:55:54.0643 7344  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D ] WebClient       C:\Windows\System32\webclnt.dll
21:55:54.0658 7344  WebClient - ok
21:55:54.0674 7344  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
21:55:54.0705 7344  Wecsvc - ok
21:55:54.0721 7344  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
21:55:54.0799 7344  wercplsupport - ok
21:55:54.0830 7344  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
21:55:54.0861 7344  WerSvc - ok
21:55:54.0877 7344  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
21:55:54.0908 7344  WfpLwf - ok
21:55:54.0908 7344  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
21:55:54.0924 7344  WIMMount - ok
21:55:54.0939 7344  WinDefend - ok
21:55:54.0955 7344  WinHttpAutoProxySvc - ok
21:55:55.0002 7344  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
21:55:55.0033 7344  Winmgmt - ok
21:55:55.0095 7344  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll
21:55:55.0189 7344  WinRM - ok
21:55:55.0251 7344  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
21:55:55.0267 7344  WinUsb - ok
21:55:55.0298 7344  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll
21:55:55.0345 7344  Wlansvc - ok
21:55:55.0360 7344  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
21:55:55.0376 7344  WmiAcpi - ok
21:55:55.0392 7344  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
21:55:55.0423 7344  wmiApSrv - ok
21:55:55.0423 7344  WMPNetworkSvc - ok
21:55:55.0438 7344  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
21:55:55.0454 7344  WPCSvc - ok
21:55:55.0485 7344  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
21:55:55.0501 7344  WPDBusEnum - ok
21:55:55.0516 7344  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
21:55:55.0563 7344  ws2ifsl - ok
21:55:55.0579 7344  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\system32\wscsvc.dll
21:55:55.0610 7344  wscsvc - ok
21:55:55.0610 7344  WSearch - ok
21:55:55.0688 7344  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
21:55:55.0782 7344  wuauserv - ok
21:55:55.0813 7344  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
21:55:55.0813 7344  WudfPf - ok
21:55:55.0844 7344  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
21:55:55.0875 7344  WUDFRd - ok
21:55:55.0906 7344  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
21:55:55.0922 7344  wudfsvc - ok
21:55:55.0953 7344  [ 04F82965C09CBDF646B487E145060301 ] WwanSvc         C:\Windows\System32\wwansvc.dll
21:55:55.0969 7344  WwanSvc - ok
21:55:55.0984 7344  ================ Scan global ===============================
21:55:56.0000 7344  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
21:55:56.0047 7344  [ 88EDD0B34EED542745931E581AD21A32 ] C:\Windows\system32\winsrv.dll
21:55:56.0047 7344  [ 88EDD0B34EED542745931E581AD21A32 ] C:\Windows\system32\winsrv.dll
21:55:56.0078 7344  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
21:55:56.0109 7344  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
21:55:56.0109 7344  [Global] - ok
21:55:56.0109 7344  ================ Scan MBR ==================================
21:55:56.0125 7344  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
21:55:56.0406 7344  \Device\Harddisk0\DR0 - ok
21:55:56.0406 7344  ================ Scan VBR ==================================
21:55:56.0406 7344  [ C6E5559618E0448A5BA44CB1C139F045 ] \Device\Harddisk0\DR0\Partition1
21:55:56.0406 7344  \Device\Harddisk0\DR0\Partition1 - ok
21:55:56.0421 7344  [ 66FF529C745EE46049F78824BD712781 ] \Device\Harddisk0\DR0\Partition2
21:55:56.0421 7344  \Device\Harddisk0\DR0\Partition2 - ok
21:55:56.0437 7344  [ 2959D2BCCC7C41C21BF3466CD5DC2B62 ] \Device\Harddisk0\DR0\Partition3
21:55:56.0437 7344  \Device\Harddisk0\DR0\Partition3 - ok
21:55:56.0437 7344  ============================================================
21:55:56.0437 7344  Scan finished
21:55:56.0437 7344  ============================================================
21:55:56.0452 6576  Detected object count: 1
21:55:56.0452 6576  Actual detected object count: 1
21:56:09.0931 6576  AVMPowerlineService ( UnsignedFile.Multi.Generic ) - skipped by user
21:56:09.0931 6576  AVMPowerlineService ( UnsignedFile.Multi.Generic ) - User select action: Skip

Grüße

Lukas

11.05.2014, 22:58	#10
Bootsektor Ruhe in Frieden † 2019	Windows 7: “Trojan.Win32.Jorik.Androm.pep” Hallo Lukas, was hat ad-aware wo gefunden? Nein du hast immer noch Malware auf deinem Rechner, bitte mache Schritt 2 aus meinem vorherigen Post. __________________ Grüße stolzes Mitglied von UNITE Du hast Lob oder Verbesserungsvorschläge? Du findest unsere Arbeit gut und möchtest uns finanziell unterstützen? -> Spende

Windows 7: “Trojan.Win32.Jorik.Androm.pep”

Log-Analyse und Auswertung: Windows 7: “Trojan.Win32.Jorik.Androm.pep”