Controlle nach Massiven Netzwerkstörungen durch Netzwerk Scaner

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 07.05.2014
Scan Time: 21:51:54
Logfile: Malwarebytes.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.03.04.09
Rootkit Database: v2014.02.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: 42

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 290675
Time Elapsed: 23 min, 45 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 1
PUP.Optional.Conduit.A, HKU\S-1-5-21-2964411297-4113465080-1101347880-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&SSPV=),Replaced,[ce7ba15e7efcc670a9020e177292af51]

Folders: 2
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86], 
PUP.Optional.OpenCandy, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4, Quarantined, [6edb32cdc4b643f3c1ca3f470bf77a86], 

Files: 8
PUP.Optional.Conduit.A, C:\Users\42\AppData\Roaming\OpenCandy\8B5C3A364B724F3285E01E59A4B0ACA4\SSStub_SearchProtect_p1v0.exe, Quarantined, [0e3b12edbbbf70c62b518fcf9968e41c], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsr59C8.exe, Quarantined, [cd7ca35c7ffba393df75f67536cb718f], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw56DA.exe, Quarantined, [361324dbc1b9ee48243003683fc2f10f], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsw70C2.exe, Quarantined, [8fba26d9700a37ff054fd7945ba63bc5], 
PUP.Optional.Somoto, C:\Users\42\AppData\Local\Temp\UpdateCheckerSetup.exe, Quarantined, [1d2c609f90ea72c4f4e3a5cf43bd06fa], 
PUP.Optional.ShowPass.A, C:\Users\42\AppData\Local\Temp\Show-Password_1030-8102.exe, Quarantined, [f851d7289edc2f070c8be2b0659c46ba], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm430C.exe, Quarantined, [0445c53a74067cbae66ef77423de639d], 
PUP.Optional.SearchProtect.A, C:\Users\42\AppData\Local\Temp\nsm7391.exe, Quarantined, [08418f704b2f23131d37cd9efd0408f8], 

Physical Sectors: 0
(No malicious items detected)


(end)
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-05-2014
Ran by 42 at 2014-05-07 23:56:18
Running from C:\Users\42\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

==================== Installed Programs ======================

3Dconnexion 3DxSoftware (x64 Edition) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 3.17.8 - 3Dconnexion)
3Dconnexion 3DxWare (x64) (Version: 6.17.0008 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2014 (Version: 1.12.4 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.2 - 3Dconnexion) Hidden
7-PDF Printer 10.0.0.1840 (HKLM\...\7-PDF Printer_is1) (Version: 10.0.0.1840 - 7-PDF, Germany - Th. Hodes)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
AutoCAD Electrical 2014 - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
AutoCAD Electrical 2014 Language Pack - Deutsch (German) (Version: 11.0.57.0 - Autodesk) Hidden
Autodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)
Autodesk App Manager (HKLM-x32\...\{C070121A-C8C5-4D52-9A7D-D240631BD433}) (Version: 1.1.0 - Autodesk)
Autodesk AutoCAD Electrical 2014 - Deutsch (German) (HKLM\...\AutoCAD Electrical 2014 - Deutsch (German)) (Version: 11.0.57.0 - Autodesk)
Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)
Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) Hidden
Autodesk Design Review 2013 (HKLM-x32\...\Autodesk Design Review 2013) (Version: 13.0.0.82 - Autodesk, Inc.)
Autodesk Design Review 2013 (x32 Version: 13.0.0.82 - Autodesk, Inc.) Hidden
Autodesk Download Manager (HKLM-x32\...\{2F48C80C-3A76-495A-A4B5-C0CC946FEEBD}) (Version: 2.0.6.0 - Autodesk, Inc.)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
Autodesk Featured Apps (HKLM-x32\...\{F732FEDA-7713-4428-934B-EF83B8DD65D0}) (Version: 1.1.0 - Autodesk)
Autodesk Inventor Content Center Libraries 2014 (Desktop Content) (HKLM\...\{B46DECD1-1864-4EF1-0000-22D71E81877C}) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Fusion 2013 R1 (HKLM\...\Autodesk Inventor Fusion 2013 R1) (Version: 3.0.0.5 - Autodesk, Inc.)
Autodesk Inventor Fusion 2013 R1 (Version: 3.0.0.5 - Autodesk, Inc.) Hidden
Autodesk Inventor Professional 2014 - Deutsch (German) (HKLM\...\Autodesk Inventor Professional 2014) (Version: 18.0.17000.0000 - Autodesk)
Autodesk Inventor Professional 2014 (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Inventor Professional 2014 Language Pack - Deutsch (German) (Version: 18.0.17000.0000 - Autodesk) Hidden
Autodesk Material Library 2013 (HKLM-x32\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM-x32\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.14 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2014 (HKLM-x32\...\{5C29CC1F-218F-4C30-948A-11066CAC59FB}) (Version: 4.0.19.0 - Autodesk)
Autodesk ReCap (HKLM\...\Autodesk ReCap) (Version: 1.0.43.27 - Autodesk)
Autodesk ReCap (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk ReCap Language Pack-English (Version: 1.0.43.27 - Autodesk) Hidden
Autodesk Revit Interoperability for Inventor 2014 (HKLM\...\Autodesk Revit Interoperability for Inventor 2014) (Version: 13.02.15161 - Autodesk)
Autodesk Revit Interoperability for Inventor 2014 (Version: 13.02.15161 - Autodesk) Hidden
Autodesk Simulation Mechanical 2014 (HKLM\...\Autodesk Simulation Mechanical 2014) (Version: 2014.00.00.0513 - Autodesk, Inc.)
Autodesk Simulation Mechanical 2014 (Version: 2014.00.00.0513 - Autodesk, Inc.) Hidden
Autodesk Vault Basic 2014 (Client) (HKLM\...\Autodesk Vault Basic 2014 (Client)) (Version: 18.0.86.0 - Autodesk)
Autodesk Vault Basic 2014 (Client) (Version: 18.0.86.0 - Autodesk) Hidden
Autodesk Vault Basic 2014 (Client) German Language Pack (Version: 18.0.86.0 - Autodesk) Hidden
CADE Pro 2.20.3 (HKLM-x32\...\{0D050176-09B9-437C-9E9C-B3E84614D32E}) (Version: 2.20.3 - Weresc)
CIROS Automation Suite Updater (HKLM-x32\...\CIROS Automation Suite Updater5.1) (Version: 5.1 - RIF e.V.)
CIROS Studio (HKLM-x32\...\CIROS Studio5.1) (Version: 5.1 - RIF e.V.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.2.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
CrystalDiskInfo 6.0.4 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.4 - Crystal Dew World)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dungeon Keeper Gold (HKLM-x32\...\GOGPACKDUNGEONKEEPER_is1) (Version: 2.0.0.4 - GOG.com)
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
EasyPort ActiveX Control V2.1 (HKLM-x32\...\EasyPort) (Version:  - )
Eco Materials Adviser for Autodesk Inventor 2014 (64-bit) (HKLM\...\{530B8614-C5DE-475B-AF6F-71BED461552C}) (Version: 4.4.1.0 - Granta Design Limited)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.64.2 - Lenovo Group Limited)
EzOPC V5.4 (HKLM-x32\...\EzOPC 5) (Version:  - )
FARO LS 1.1.501.0 (64bit) (HKLM-x32\...\{8A470330-70B2-49AD-86AF-79885EF9898A}) (Version: 5.1.0.30630 - FARO Scanner Production)
Fresco Logic USB3.0 Host Controller (HKLM\...\{3534A6A6-D6CF-415E-B2C5-E97BEE8A6639}) (Version: 3.0.110.12 - Fresco Logic Inc.)
G I - Die Welt der Verurteilten (mit neuen Texturen) (HKLM-x32\...\G I - Die Welt der Verurteilten (mit neuen Texturen)) (Version: 1.03 - Issues (Deadgame Inc.))
GameRanger (HKCU\...\GameRanger) (Version:  - GameRanger Technologies)
Gothic (HKLM-x32\...\Steam App 65540) (Version:  - Piranha – Bytes )
Gothic II: Gold Edition (HKLM-x32\...\Steam App 39510) (Version:  - Piranha – Bytes)
inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.28.0 (HKLM-x32\...\{A87263E8-26CB-1016-8F2F-C04708B17CE2}) (Version: 1.2.28.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) PRO/Wireless Driver (Version: 16.01.3000.0512 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 16.1.1.0084 - Intel Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{828af006-cb5e-4d60-957a-523098a1b0f8}) (Version: 16.1.3 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.3000.0254 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
LOGO!Soft Comfort V7.0 (Demo) (HKLM\...\LOGO!Soft Comfort V7.0 (Demo)) (Version: 7.0.0.0 - Siemens AG)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
MATLAB R2013a (HKLM\...\Matlab R2013a) (Version: 8.1 - The MathWorks, Inc.)
Max Payne 2 DE (HKLM-x32\...\Steam App 210410) (Version:  - )
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00 - Microsoft Corporation) Hidden
Microsoft Visual Basic for Applications 7.1 (x64) German (Version: 7.1.0.0 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 x64 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x64 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MiKTeX 2.9 (HKCU\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Miranda IM 0.10.21 (HKLM-x32\...\Miranda IM) (Version: 0.10.21 - Miranda IM Project)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MTpro 3.6 (HKLM-x32\...\MTpro) (Version: 3.6.0.2 - Bosch Rexroth AG)
MTproLight 3.6 (HKLM-x32\...\MTproLight) (Version: 3.6.0.1 - Bosch Rexroth AG)
NETGEAR Print Server Software (HKLM-x32\...\{A3DF5B33-FB8B-43FE-A943-A24CF6030F61}) (Version: 1.0 - NETGEAR)
Network Notepad 4.6.9 (HKLM-x32\...\Netnotep_is1) (Version:  - Jason Green)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
OPC Core Components Redistributable (HKLM-x32\...\{75F9DAD1-792C-44E9-B48B-2E22C76E0CBF}) (Version: 3.00.102 - OPC Foundation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PKZIP Server for Windows 12.40.0008 (HKLM-x32\...\{134A51EB-1BBB-4249-BAF5-494C3D186A06}) (Version: 12.40.0008 - PKWARE, Inc)
Railroad Tycoon 2: Platinum (HKLM-x32\...\Steam App 7620) (Version:  - PopTop)
RICOH_Media_Driver_v2.14.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
Rome - Total War - Gold Edition (HKLM-x32\...\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}) (Version: 1.6 - The Creative Assembly)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Serious Sam Classic: The First Encounter (HKLM-x32\...\Steam App 41050) (Version:  - Croteam)
Sid Meier's Railroad Tycoon (HKLM-x32\...\Sid Meier's Railroad Tycoon) (Version: 1.0 - 2K Games)
Siemens Automation License Manager (Version: 05.01.0100 - Siemens AG) Hidden
Siemens Automation License Manager V5.1 + SP1   (HKLM\...\{8D2E0408-8D61-4A53-B0DB-2AD670A38624}LicenseManager) (Version: 05.01.0100 - Siemens AG)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{35002267-F746-4F77-9B97-125305EF65C6}) (Version: 6.2.00 - Silicon Laboratories, Inc.)
SIMATIC  STEP 7 (x32 Version: 05.05.0200 - Siemens AG) Hidden
SIMATIC  STEP 7 V5.5 + SP2 Professional 2010 SR2   (HKLM-x32\...\{7B427E8E-F76D-4C8C-B155-7F24DF46DB67}STEP7) (Version: 05.05.0200 - Siemens AG)
SIMATIC Device Drivers (Version: 01.00.0200 - Siemens AG) Hidden
SIMATIC NCM FWL 64 (Version: 05.05.0100 - Siemens AG) Hidden
SIMATIC PLCSIM 64 (Version: 01.00.0001 - Siemens AG) Hidden
SIMATIC S7-GRAPH (x32 Version: 05.03.0700 - Siemens AG) Hidden
SIMATIC S7-GRAPH V5.3 + SP7 Professional 2010 SR2   (HKLM-x32\...\{4FF24C45-A4EE-4A99-B287-E3468EC41CBD}S7GRAPH) (Version: 05.03.0700 - Siemens AG)
SIMATIC S7-PCT (x32 Version: 02.03.0000 - Siemens AG) Hidden
SIMATIC S7-PCT V2.3 Professional 2010 SR2   (HKLM-x32\...\{06AF0F82-E926-48A6-8C5F-ECB195DB2CB4}S7PCT) (Version: 02.03.0000 - Siemens AG)
SIMATIC S7-PLCSIM (x32 Version: 5.4.0502 - Siemens AG) Hidden
SIMATIC S7-PLCSIM V5.4 + SP5 + Upd2 Professional 2010 SR2   (HKLM-x32\...\{1CBF27F6-24A4-488D-940A-678F1C691C49}PLCSim) (Version: 5.4.0502 - Siemens AG)
SIMATIC S7-SCL (x32 Version: 5.3.6.0 - Siemens AG) Hidden
SIMATIC S7-SCL V5.3 + SP6 Professional 2010 SR2   (HKLM-x32\...\{5B1B0682-EEC6-4EDD-BAB0-3FEC2E55090D}SCL) (Version: 5.3.6.0 - Siemens AG)
SketchUp Import for AutoCAD 2014 (HKLM-x32\...\{644E9589-F73A-49A4-AC61-A953B9DE5669}) (Version: 1.1.0 - Autodesk)
Sophos Anti-Virus (HKLM-x32\...\{4320988A-7DE0-478D-A38B-CE9509BCE320}) (Version: 10.3.1 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{15C418EB-7675-42be-B2B3-281952DA014D}) (Version: 2.9.0.344 - Sophos Limited)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Stronghold HD (HKLM-x32\...\Steam App 40950) (Version:  - FireFly Studios)
System Shock 2 (HKLM-x32\...\Steam App 238210) (Version:  - Irrational Games)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.13 - )
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.78.0.11 - Lenovo)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{6DA2B636-698A-3294-BF4A-B5E11B238CDD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x64 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{14866AAD-1F23-39AC-A62B-7091ED1ADE64}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Visual C++ 2008 - x86 (KB958357) - v9.0.30729.177 (HKLM-x32\...\{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}.KB958357) (Version: 9.0.30729.177 - Microsoft Corporation)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinFACT 7 (HKLM-x32\...\{FE2A7490-32EA-47D1-BCB4-0705F73F4C24}) (Version: 7.1.1 - Ingenieurbüro Dr. Kahlert)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinTrack Demo Version 11.0 3D (HKLM-x32\...\wintrack11demo_is1) (Version: 11.0 3D - Ing.-Büro Schneider)

==================== Restore Points  =========================

18-04-2014 07:40:29 Windows Update
20-04-2014 20:30:17 Windows-Sicherung
22-04-2014 07:33:16 Windows Update
25-04-2014 12:20:11 Windows Update
27-04-2014 17:00:10 Windows-Sicherung
29-04-2014 06:33:26 Windows Update
29-04-2014 07:22:23 Installed Silicon Laboratories CP210x VCP Drivers for Windows XPçtõe
03-05-2014 01:00:35 Windows Update
04-05-2014 17:00:16 Windows-Sicherung
06-05-2014 06:27:30 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {20302771-FF20-42A8-911E-CBACEAE02371} - System32\Tasks\{7CD3D0F3-3B01-4A38-BE70-13ACF72B08C9} => G:\SETUP.EXE
Task: {264116B0-5FEA-452B-B328-616B704A4DBF} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: {417E5AEE-8300-48BE-B97A-4ACC41E5E25E} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {41B89BB8-5482-468F-BA08-E70AD256BF9F} - System32\Tasks\MATLAB R2013a Startup Accelerator => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe [2013-01-16] ()
Task: {53BC6006-F4E8-4B47-A342-C8B4326C9EFB} - System32\Tasks\{4A4FD7AE-BD3F-4ABE-A332-9184D2525CBC} => G:\SETUP.EXE
Task: {AA3710D3-AACA-453B-93E2-D44DAA2FF0CF} - System32\Tasks\{5B5DCE77-D315-4B39-9A9D-747F69CB7657} => G:\SETUP.EXE
Task: {CA215D09-E318-4B3B-8C7B-61F70432D91B} - System32\Tasks\3DconnexionCreateProcess_3DxSRV.EXE => C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3DxSRV.EXE [2014-01-24] (3Dconnexion, INC)
Task: {DD1FA757-CB08-4457-80C1-A2C8EABAEDA7} - System32\Tasks\{CCACA2F1-B496-447A-A3AA-D1BCE16FE3AD} => G:\SETUP.EXE
Task: {E16447B5-EF15-41A5-A18C-7F807E0088DF} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {EB0E851A-9648-45E4-BB8A-A6D8E241A540} - System32\Tasks\{83941917-908D-4A22-9F0B-A51889FEF570} => G:\SETUP.EXE
Task: {F8C14A5C-CE14-4568-A8B5-DB4AD92630C5} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe

==================== Loaded Modules (whitelisted) =============

2014-01-24 15:04 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-07-26 11:42 - 2013-07-26 11:42 - 00034304 _____ () C:\Windows\System32\ssa3mlm.dll
2014-01-24 15:03 - 2013-10-29 09:17 - 00004096 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-01-24 15:05 - 2013-12-09 07:04 - 00117248 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-03-10 02:43 - 2011-03-10 02:43 - 00774144 _____ () C:\Program Files\Common Files\Siemens\SWS\PlugIns\SCP\Scpwin64.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00824320 _____ () C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\sn_regbase.dll
2014-01-24 15:03 - 2011-09-26 01:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-24 15:13 - 2010-10-26 11:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-02-05 01:21 - 2013-02-05 01:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll
2013-02-05 01:21 - 2013-02-05 01:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll
2011-06-14 19:24 - 2011-06-14 19:24 - 00749568 _____ () C:\Windows\SysWOW64\sn_regbase.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00057432 _____ () C:\Program Files (x86)\Miranda IM\zlib.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00036961 _____ () C:\Program Files (x86)\Miranda IM\Plugins\dbx_mmap.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00061538 _____ () C:\Program Files (x86)\Miranda IM\Plugins\clist_classic.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00203357 _____ () C:\Program Files (x86)\Miranda IM\Plugins\aim.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00245848 _____ () C:\Program Files (x86)\Miranda IM\Plugins\chat.dll
2014-01-16 00:39 - 2014-01-16 00:39 - 00339550 _____ () C:\Program Files (x86)\Miranda IM\Plugins\icq.dll
2014-01-16 00:38 - 2014-01-16 00:38 - 00379993 _____ () C:\Program Files (x86)\Miranda IM\Plugins\irc.dll
2014-01-16 00:41 - 2014-01-16 00:41 - 00090200 _____ () C:\Program Files (x86)\Miranda IM\Plugins\srmm.dll
2014-03-30 18:44 - 2014-03-30 18:44 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-13 16:43 - 2013-07-18 00:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll
2014-02-08 10:40 - 2014-02-08 10:40 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: pdflatex.EXE, Version: 0.0.0.0, Zeitstempel: 0x51c4b8b9
Name des fehlerhaften Moduls: QtGui4.dll, Version: 4.8.4.0, Zeitstempel: 0x50d7557c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0001e30d
ID des fehlerhaften Prozesses: 0x2204
Startzeit der fehlerhaften Anwendung: 0xpdflatex.EXE0
Pfad der fehlerhaften Anwendung: pdflatex.EXE1
Pfad des fehlerhaften Moduls: pdflatex.EXE2
Berichtskennung: pdflatex.EXE3

Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: jucheck.exe, Version: 2.1.9.8, Zeitstempel: 0x51d2fcc9
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x1458
Startzeit der fehlerhaften Anwendung: 0xjucheck.exe0
Pfad der fehlerhaften Anwendung: jucheck.exe1
Pfad des fehlerhaften Moduls: jucheck.exe2
Berichtskennung: jucheck.exe3

Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a144
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000021cfa
ID des fehlerhaften Prozesses: 0x10a4
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3

Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0x28f8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3

Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Name der fehlerhaften Anwendung: prevhost.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce796ac
Name des fehlerhaften Moduls: pdfprevhndlr.dll, Version: 11.0.3.37, Zeitstempel: 0x518e10a7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000028dd
ID des fehlerhaften Prozesses: 0x18d8
Startzeit der fehlerhaften Anwendung: 0xprevhost.exe0
Pfad der fehlerhaften Anwendung: prevhost.exe1
Pfad des fehlerhaften Moduls: prevhost.exe2
Berichtskennung: prevhost.exe3


System errors:
=============
Error: (05/07/2014 11:49:29 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:49:29 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (05/07/2014 11:49:25 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:45:17 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.

Error: (05/07/2014 11:33:33 PM) (Source: SCardSvr) (User: ) (EventID: 610)
Description: Das Handle ist ungültig.Lenovo Integrated Smart Card Reader 0GET_STATEXX XX XX XX

Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:30:08 PM) (Source: NetBT) (User: ) (EventID: 4321)
Description: Der Name "THINKPAD       :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.1.47
registriert werden. Der Computer mit IP-Adresse 192.168.1.46 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (05/07/2014 11:30:08 PM) (Source: Server) (User: ) (EventID: 2505)
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{BD541619-7B36-4501-98E6-B4F2C4FBA30C} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.


Microsoft Office Sessions:
=========================
Error: (05/07/2014 11:49:28 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 11:30:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/07/2014 09:53:20 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/05/2014 10:09:23 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: pdflatex.EXE0.0.0.051c4b8b9QtGui4.dll4.8.4.050d7557cc00000050001e30d220401cf68393def472aC:\Program Files (x86)\Neuer Ordner\miktex\bin\pdflatex.EXEC:\Program Files (x86)\Neuer Ordner\miktex\bin\QtGui4.dll911d1c1f-d42c-11e3-91b5-f0def1939b2a

Error: (05/04/2014 07:39:11 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: jucheck.exe2.1.9.851d2fcc9unknown0.0.0.000000000c000000500000000145801cf6540b76bc642C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exeunknown6a910fa8-d34e-11e3-91b5-f0def1939b2a

Error: (05/02/2014 07:50:30 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: explorer.exe6.1.7601.175144ce7a144ntdll.dll6.1.7601.18247521eaf24c00000050000000000021cfa10a401cf654ad6bfadd5C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dllaa9afcff-d1bd-11e3-91b5-f0def1939b2a

Error: (05/01/2014 03:19:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:16:40 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/30/2014 06:14:58 PM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acntdll.dll6.1.7601.18247521ea8e7c000000500038e1928f801cf6452869486efC:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\ntdll.dll929b1deb-d082-11e3-8f20-f0def1939b2a

Error: (04/30/2014 10:59:38 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: prevhost.exe6.1.7601.175144ce796acpdfprevhndlr.dll11.0.3.37518e10a7c0000005000028dd18d801cf63a390713850C:\Windows\SysWOW64\prevhost.exeC:\Program Files (x86)\Adobe\Reader 11.0\Reader\pdfprevhndlr.dllc1c123f9-d045-11e3-8f20-f0def1939b2a


==================== Memory info =========================== 

Percentage of memory in use: 40%
Total physical RAM: 8075.23 MB
Available physical RAM: 4802.52 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 12527.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:232.79 GB) (Free:108.56 GB) NTFS
Drive d: (Daten) (Fixed) (Total:698.63 GB) (Free:256.89 GB) NTFS
Drive e: (VOYAGER) (Removable) (Total:7.5 GB) (Free:4.2 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 776B0AC9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 8F089F77)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: 04DD5721)
Partition 1: (Active) - (Size=8 GB) - (Type=0B)

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-05-2014
Ran by 42 (administrator) on THINKPAD on 07-05-2014 23:56:00
Running from C:\Users\42\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\S7BIN\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\pniomgr.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Miranda IM) C:\Program Files (x86)\Miranda IM\miranda32.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrvlauncher.exe
(Akamai Technologies, Inc.) C:\Users\42\AppData\Local\Akamai\netsession_win.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SIEMENS AG) C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\Common Files\Siemens\SQLANY\dbsrv9.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2013-11-29] (Lenovo.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-11-15] (Synaptics Incorporated)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [929272 2013-01-11] (Sophos Limited)
HKLM-x32\...\Run: [FLxHCIm] => C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [37888 2010-11-19] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1641368 2013-02-01] (Autodesk, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [S7UB Start] => C:\Program Files (x86)\Common Files\Siemens\S7ubtoox\s7ubtstx.exe [102453 2010-06-03] (SIEMENS AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DudeServer] => C:\Program Files (x86)\Dude\dude.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Akamai NetSession Interface] => C:\Users\42\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: G - G:\Launch.exe
HKU\S-1-5-21-2964411297-4113465080-1101347880-1000\...\MountPoints2: {d8c62dfd-84f4-11e3-a90e-c38adcc6c8f1} - G:\shelexec.exe -! "start<CN=*Adobe*:!V!>.pdf" -DefaultApp:<base>\adobe\acrobat5\win\Reader\AcroRd32.exe -QueryApp
HKU\S-1-5-21-2964411297-4113465080-1101347880-1003\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-02-25] (Sophos Limited)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-10-29] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-02-25] (Sophos Limited)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk
ShortcutTarget: GameRanger.lnk -> C:\Users\42\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)
Startup: C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\miranda32.exe - Verknüpfung.lnk
ShortcutTarget: miranda32.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start 3DxWare.lnk
ShortcutTarget: Start 3DxWare.lnk -> C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exe (3Dconnexion, INC)

==================== Internet (Whitelisted) ====================

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP9997346B-FE10-4EAC-ACF8-590F1D8D1865&q={searchTerms}&SSPV=
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [89592] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [132904] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 83.169.186.225 83.169.186.161
Tcpip\..\Interfaces\{27AC9502-D313-4684-A030-BA6A87B7E6CC}: [NameServer]192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Gmail Watcher - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\gmailwatcher@sonthakit.xpi [2014-01-24]
FF Extension: Adblock Plus - C:\Users\42\AppData\Roaming\Mozilla\Firefox\Profiles\cb7kpe2f.default-1390571193923\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-24]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-02-13]

==================== Services (Whitelisted) =================

R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1542792 2011-10-28] (SIEMENS AG)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-02] ()
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-10-31] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-11-03] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-11-03] (SIEMENS AG)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [290296 2013-09-17] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [206328 2013-09-17] (Sophos Limited)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [237048 2013-01-11] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [357400 2013-09-17] (Sophos Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3109880 2013-09-17] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2012152 2013-09-17] (Sophos Limited)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-02] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-24] (Disc Soft Ltd)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [49664 2010-11-19] (Fresco Logic)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-10-20] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107520 2011-10-20] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-09-29] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-09-29] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [193024 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [154952 2013-09-17] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [36640 2013-09-17] (Sophos Limited)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2013-11-15] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-10-11] (SIEMENS AG)
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2013-09-17] (Sophos Plc)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:30 - 2014-05-07 23:56 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:30 - 2014-05-07 22:22 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 23:30 - 2014-05-07 22:01 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:03 - 2014-05-07 23:56 - 00000000 ____D () C:\FRST
2014-05-07 22:03 - 2014-05-07 22:04 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 21:28 - 2014-05-07 23:49 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-07 21:26 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-07 21:26 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-07 21:26 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-05 12:23 - 2014-05-07 21:53 - 00000691 _____ () C:\dude.conf
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-05-03 03:00 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 03:00 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 03:00 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 03:00 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:21 - 2014-04-30 18:15 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2012-05-30 13:42 - 00569152 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-15 16:42 - 2014-04-15 16:43 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-11 14:21 - 2014-04-08 11:31 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-11 14:21 - 2014-04-07 21:14 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt
2014-04-11 14:21 - 2014-04-02 14:37 - 00018778 _____ () C:\Users\42\Documents\Schaltkasten%20Verdratung.xls_0.ods
2014-04-10 10:59 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 10:59 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 10:59 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 10:59 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 10:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 10:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 10:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 10:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 10:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 10:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 10:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 10:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 10:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 10:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 10:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 10:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 10:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 10:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 10:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 10:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 10:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 10:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 10:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 10:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 10:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 10:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 10:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 10:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 10:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 09:03 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 09:02 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 09:02 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 09:02 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 09:02 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 09:02 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

==================== One Month Modified Files and Folders =======

2014-05-07 23:56 - 2014-05-07 23:30 - 00021252 _____ () C:\Users\42\Desktop\FRST.txt
2014-05-07 23:56 - 2014-05-07 22:03 - 00000000 ____D () C:\FRST
2014-05-07 23:55 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-05-07 23:55 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-05-07 23:55 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-07 23:52 - 2014-01-24 14:45 - 01638570 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 23:49 - 2014-05-07 21:28 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-07 23:49 - 2014-01-24 18:09 - 00000540 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2014-05-07 23:49 - 2014-01-24 15:04 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-07 23:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 23:49 - 2009-07-14 06:51 - 00066845 _____ () C:\Windows\setupact.log
2014-05-07 23:47 - 2014-05-07 23:47 - 00024320 _____ () C:\Users\42\Desktop\GMER.log
2014-05-07 23:39 - 2014-05-07 23:39 - 00024320 _____ () C:\Users\42\Documents\GMER.log
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-07 23:37 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-07 22:53 - 2014-05-07 22:53 - 00000168 _____ () C:\Users\42\defogger_reenable
2014-05-07 22:53 - 2014-01-24 14:45 - 00000000 ____D () C:\Users\42
2014-05-07 22:22 - 2014-05-07 23:30 - 00380416 _____ () C:\Users\42\Desktop\Gmer-19357.exe
2014-05-07 22:15 - 2014-05-07 22:15 - 00000000 ____D () C:\Users\42\AppData\Local\Sophos
2014-05-07 22:14 - 2014-05-07 22:14 - 00002817 _____ () C:\Users\42\Desktop\Malwarebytes.txt
2014-05-07 22:04 - 2014-05-07 22:03 - 00037698 _____ () C:\Users\42\Desktop\Addition.txt
2014-05-07 22:01 - 2014-05-07 23:30 - 02063872 _____ (Farbar) C:\Users\42\Desktop\FRST64.exe
2014-05-07 21:53 - 2014-05-05 12:23 - 00000691 _____ () C:\dude.conf
2014-05-07 21:52 - 2010-11-21 05:47 - 00026106 _____ () C:\Windows\PFRO.log
2014-05-07 21:27 - 2014-05-07 21:27 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-07 21:27 - 2014-05-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-07 21:27 - 2014-05-07 21:26 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-07 21:26 - 2014-05-07 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-05 12:21 - 2014-03-09 22:19 - 00000000 ____D () C:\Users\42\AppData\Roaming\WinTrack
2014-05-03 09:52 - 2014-05-03 09:52 - 00000079 _____ () C:\Users\42\Desktop\ToDo.txt
2014-04-30 18:15 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\.LOGOComfort7.0
2014-04-29 16:01 - 2014-05-03 03:00 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 03:00 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 09:22 - 2014-04-29 09:22 - 00000000 ____D () C:\SiLabs
2014-04-29 09:22 - 2014-01-24 15:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Users\42\InstallAnywhere
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ___HD () C:\Program Files\Zero G Registry
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Users\42\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Siemens LOGO!Soft
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\tmp
2014-04-29 09:21 - 2014-04-29 09:21 - 00000000 ____D () C:\Program Files\Siemens
2014-04-28 14:45 - 2014-01-24 15:05 - 00000000 ____D () C:\Users\42\AppData\Local\Lenovo
2014-04-27 15:53 - 2014-04-27 15:53 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\ProgramData\Lenovo
2014-04-27 15:53 - 2014-01-24 14:49 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-04-27 15:52 - 2014-02-08 03:04 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-04-24 18:16 - 2014-01-24 23:19 - 00000000 ____D () C:\Users\42\AppData\Local\Akamai
2014-04-23 13:40 - 2014-01-24 23:37 - 00000000 ____D () C:\Users\42\Documents\Inventor
2014-04-23 13:36 - 2014-02-02 23:07 - 00106518 _____ () C:\Windows\system32\webservice4.log
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Battery Utility 2014
2014-04-21 12:38 - 2014-04-21 12:38 - 00000000 ____D () C:\Program Files (x86)\Lenovo Battery Utility 2014
2014-04-21 11:29 - 2014-01-24 19:05 - 00000000 ____D () C:\Users\42\Documents\MATLAB
2014-04-17 23:16 - 2014-01-24 17:41 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-15 16:43 - 2014-04-15 16:42 - 00000000 ____D () C:\Program Files (x86)\WinMerge
2014-04-15 16:42 - 2014-04-15 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2014-04-10 18:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 11:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 03:02 - 2014-01-24 16:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 03:01 - 2014-01-24 16:37 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-09 01:10 - 2014-01-24 14:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-08 11:31 - 2014-04-11 14:21 - 00009740 _____ () C:\Users\42\Documents\untitled_0.ods
2014-04-07 21:14 - 2014-04-11 14:21 - 00021849 _____ () C:\Users\42\Documents\Anfrake%20Schunk.odt_0.odt

Some content of TEMP:
====================
C:\Users\42\AppData\Local\Temp\AcDeltree.exe
C:\Users\42\AppData\Local\Temp\Ct64Setup.exe
C:\Users\42\AppData\Local\Temp\DLMGuardian.exe
C:\Users\42\AppData\Local\Temp\exie.exe
C:\Users\42\AppData\Local\Temp\expb.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\42\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\42\AppData\Local\Temp\Procmon64.exe
C:\Users\42\AppData\Local\Temp\simaticn.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 08:59

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-08 00:06:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Samsung_ rev.EXT0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\42\AppData\Local\Temp\uwlyipog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                             000007fefd8b2db0 5 bytes JMP 000007fffd8a0180
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                        000007fefd8b37d0 7 bytes JMP 000007fffd8a00d8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                          000007fefd8b8ef0 6 bytes JMP 000007fffd8a0148
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                      000007fefd8caf60 5 bytes JMP 000007fffd8a0110
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                       000007feff2289e0 8 bytes JMP 000007fffd8a01f0
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                     000007feff22be40 8 bytes JMP 000007fffd8a01b8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                             000007fef7eedc88 5 bytes JMP 000007fff7ec00d8
.text  C:\Windows\system32\Dwm.exe[2612] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                            000007fef7eede10 5 bytes JMP 000007fff7ec0110
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!CopyFileExW                                                                                   00000000778e1890 5 bytes JMP 000000016fff00d8
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW                                                                         000000007795f490 8 bytes JMP 000000016fff0110
.text  C:\Windows\Explorer.EXE[2784] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                 000007feff027490 11 bytes JMP 000007fffeff00d8
.text  C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000077691465 2 bytes [69, 77]
.text  C:\Windows\system32\hasplms.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[3348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\SAsrv.exe[3772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[4056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                   00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\pniopcac.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000077691465 2 bytes [69, 77]
.text  C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000077691465 2 bytes [69, 77]
.text  C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                            0000000077691465 2 bytes [69, 77]
.text  C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[4648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                          0000000077691465 2 bytes [69, 77]
.text  C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[4660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                         00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher                                                               0000000077be0124 5 bytes JMP 0000000175348620
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                              0000000077c0c4dd 5 bytes JMP 0000000175344e10
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread                                                                       0000000077c2801c 5 bytes JMP 0000000175344ff0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFile                                                                            00000000766e1282 5 bytes JMP 0000000175344e70
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!FreeLibrary                                                                          00000000766e3488 5 bytes JMP 0000000175345240
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtect                                                                       00000000766e4327 5 bytes JMP 0000000175344ed0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA                                                                       00000000766e48db 5 bytes JMP 0000000175344f50
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryW                                                                         00000000766e48f3 5 bytes JMP 0000000175344f10
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW                                                                       00000000766e4925 5 bytes JMP 0000000175344f30
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                         00000000766e499f 5 bytes JMP 0000000175344f70
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateFileA                                                                          00000000766e538e 5 bytes JMP 0000000175345070
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GlobalAlloc                                                                          00000000766e5856 5 bytes JMP 0000000175344f90
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                                          00000000766e79d8 5 bytes JMP 0000000175345010
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA                                                               00000000766fa48f 5 bytes JMP 0000000175345030
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory                                                                   00000000766fd9b0 5 bytes JMP 0000000175344e30
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!GetThreadContext                                                                     000000007670799c 5 bytes JMP 0000000175344fb0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx                                                                     0000000076764aff 5 bytes JMP 0000000175344eb0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!WriteFileEx                                                                          0000000076764b2f 5 bytes JMP 0000000175344e50
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\kernel32.dll!SetThreadContext                                                                     00000000767658d3 5 bytes JMP 0000000175344ef0
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                               0000000077691465 2 bytes [69, 77]
.text  C:\Windows\SysWOW64\rundll32.exe[5076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Miranda IM\miranda32.exe[5084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                            0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\AppData\Local\Akamai\netsession_win.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                           00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe[5456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe[5624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5828] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Common Files\Siemens\S7UBTOOX\S7ubtoox.exe[1884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[6116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[7484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[1296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                         0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                        00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000077691465 2 bytes [69, 77]
.text  C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavMain.exe[7544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                   00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2
.text  C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                             0000000077691465 2 bytes [69, 77]
.text  C:\Users\42\Desktop\Gmer-19357.exe[8160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                            00000000776914bb 2 bytes [69, 77]
.text  ...                                                                                                                                                          * 2

---- EOF - GMER 2.1 ----