Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


Plagegeister aller Art und deren Bekämpfung: TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 20.05.2014, 05:51   #1
trampeltier
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


Guten Morgen!

Vor 3-4 Tagen wurde mein Laptop ein wenig langsamer, bis es am Sonntag auf einmal unerträglich wurde. Ich wollte zu erst eine Systemwiederherstellung durchführen, was jedoch nicht möglich war, durch die Trägheit. Zu dem Zeitpunkt ging ich von einem Virus/Trojaner aus. Dann startete ich den Computer im abgesicherten Modus und hatte ebenfalls mit der Geschwindigkeit zu kämpfen. Er verhielt sich quasi wie im normalen Modus. Als ich nun versuchte die Systemwiederherstellung zu starten, wurde mir gesagt, dass die Festplatte beschädigt sei und repariert oder getauscht werden müsse.
Ich versuchte nun die Daten zu retten und bekam währenddessen eine Meldung von AntiVir, dass ich folgenden Trojaner hätte:
Der Zugriff auf die Datei 'C:\Program Files\Common Files\...\offfiltx.dll' mit dem Virus oder dem unerwünschten Programm 'TR7Crypt.EPACK.Gen2' wurde blockiert.
parallel wurde mir dann kurz später auch noch etwas zur Festplatte geschrieben. (Screenshot)

Daher weiß ich nun nicht, ob es am Trojaner liegt oder der Festplatte oder ggf beides ist. Interessanter Weise geht aktuell alles auch wieder normal schnell.

hier noch der Screenshot:


Sollte ich vorerst wie in diesem Thread vorgehen:
http://www.trojaner-board.de/153887-...pack-gen2.html

Oder lohnt es sich ggf nicht, weil die Festplatte so und so vielleicht einen Knacks hat?

Danke und beste Grüße!
tramp

ps: Nutze als Betriebssystem win7

Alt 20.05.2014, 05:59   #2
schrauber
/// the machine
/// TB-Ausbilder
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


hi,

vollen Pfad zum Fund von Avira? Nebenbei: Alles was bei Avira mit Crypt.EPACK oder Xpack oder so anfängt is zu 99,9999999999% ein Fehlalarm.



Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 20.05.2014, 06:16   #3
trampeltier
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


FRST

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:17-05-2014
Ran by Mirko (administrator) on MIRKO-VAIO on 20-05-2014 07:12:13
Running from C:\Users\Mirko\Downloads
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\System32\DFDWiz.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.7\GoogleCrashHandler.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(CANON INC.) C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Sony Corporation) C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(ArcSoft, Inc.) C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\Admload.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9398888 2010-11-01] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-25] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1873192 2010-11-01] (Synaptics Incorporated)
HKLM\...\Run: [ISBMgr.exe] => C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2757312 2011-02-15] (Sony Corporation)
HKLM\...\Run: [PMBVolumeWatcher] => c:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2516296 2010-03-24] (CANON INC.)
HKLM\...\Run: [IJNetworkScanUtility] => C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2010-03-02] (CANON INC.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Reader Application Helper] => C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2007392 2014-04-01] (Wondershare)
HKLM\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-05-13] (LogMeIn Inc.)
HKU\S-1-5-21-2837224145-4290876003-1718813567-1001\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKU\S-1-5-21-2837224145-4290876003-1718813567-1001\...\Run: [Facebook Update] => C:\Users\Mirko\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-01-24] (Facebook Inc.)
HKU\S-1-5-21-2837224145-4290876003-1718813567-1001\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mirko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Mirko\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {35318879-41EA-4F52-AA6D-CB7BBF4CAD0C} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {3711784D-2B2E-454A-AACE-0C0B1EB4F70E} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @sony.com/ReaderDesktop - C:\Program Files\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Mirko\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-23]
FF Extension: Flash and Video Download - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2014-05-14]
FF Extension: Video HTML5 Converter Light - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\{38e5bc3a-fafb-41fc-ad55-16ba866b1334}.xpi [2013-11-16]
FF Extension: {aab4b23f-1675-435d-8bb8-70b97b37cd28} - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\{aab4b23f-1675-435d-8bb8-70b97b37cd28}.xpi [2013-11-13]
FF Extension: Adblock Plus - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-28]
FF Extension: Adblock Edge - C:\Users\Mirko\AppData\Roaming\Mozilla\Firefox\Profiles\b1gclun0.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-07-02]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-10]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"

========================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [294400 2011-05-25] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1682768 2014-05-13] (LogMeIn Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-04-22] (SurfRight B.V.)
S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2014-04-15] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-16] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files\OpenVPN2911\bin\openvpnserv.exe [29920 2013-06-03] (The OpenVPN Project)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [189048 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [64704 2011-03-05] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [549616 2011-05-19] (Sony Corporation)
R3 VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [44736 2011-02-14] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [866952 2011-07-04] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1020976 2013-09-25] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

R0 amd_sata; C:\Windows\System32\drivers\amd_sata.sys [64128 2011-02-17] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\drivers\amd_xata.sys [32384 2011-02-17] (Advanced Micro Devices)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [297000 2010-11-01] (Broadcom Corporation.)
R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [42592 2014-05-08] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-13] (Avira GmbH)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [31360 2013-02-08] (The OpenVPN Project)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva-6.sys [43120 2013-07-19] (Cisco Systems, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Mirko\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-20 07:12 - 2014-05-20 07:12 - 00017408 _____ () C:\Users\Mirko\Downloads\FRST.txt
2014-05-20 07:12 - 2014-05-20 07:12 - 00000000 ____D () C:\FRST
2014-05-20 07:10 - 2014-05-20 07:10 - 01056768 _____ (Farbar) C:\Users\Mirko\Downloads\FRST.exe
2014-05-18 21:35 - 2014-05-19 03:25 - 00007607 _____ () C:\Users\Mirko\AppData\Local\Resmon.ResmonCfg
2014-05-18 15:34 - 2014-05-18 15:34 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_24
2014-05-18 15:27 - 2014-05-18 15:29 - 00142984 _____ () C:\Windows\Minidump\051814-196779-01.dmp
2014-05-18 15:25 - 2014-05-18 15:25 - 325082699 _____ () C:\Windows\MEMORY.DMP
2014-05-15 19:33 - 2014-05-15 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-15 19:33 - 2014-05-15 19:33 - 00000000 ____D () C:\Program Files\LogMeIn Hamachi
2014-05-15 14:43 - 2014-05-15 14:17 - 00000472 _____ () C:\Users\Mirko\Desktop\dateiliste.csv
2014-05-15 14:19 - 2014-05-15 14:19 - 01757326 _____ () C:\Users\Mirko\Downloads\Basisseminar__Mediävistik_1.2_-_Tierfabeln-Dokumente.zip
2014-05-15 09:43 - 2014-05-15 10:06 - 02937399 _____ () C:\Users\Mirko\Desktop\Die Passion Christi [Automatisch gespeichert].pptx
2014-05-15 09:33 - 2014-05-15 09:33 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 09:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 09:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 09:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 17:37 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 17:37 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 17:37 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 17:37 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 17:37 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 17:37 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 17:37 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 17:37 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 17:37 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 17:37 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 17:37 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 17:37 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 17:37 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 17:37 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 17:36 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 15:59 - 2014-05-14 15:59 - 00829636 _____ () C:\Users\Mirko\Desktop\Die Passion Christi.pptx
2014-05-14 15:59 - 2014-05-14 15:59 - 00000165 ____H () C:\Users\Mirko\Desktop\~$Die Passion Christi.pptx
2014-05-14 05:42 - 2014-05-14 05:42 - 00002770 _____ () C:\Windows\PFRO.log
2014-05-13 14:26 - 2014-05-13 14:30 - 01030808 _____ () C:\Users\Mirko\Desktop\jpdf
2014-05-13 14:09 - 2014-05-13 14:10 - 100225891 ____T () C:\Users\Mirko\Desktop\pic_2014-05-20_084056.ps
2014-05-13 14:06 - 2014-05-13 14:06 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\PDF Architect 2
2014-05-13 14:01 - 2014-05-13 14:01 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-05-13 13:58 - 2014-05-13 13:59 - 27843432 _____ (pdfforge ) C:\Users\Mirko\Downloads\pdfcreator-1_7_3_setup.exe
2014-05-13 13:49 - 2014-05-13 13:49 - 00000000 ____D () C:\Users\Mirko\AppData\Local\Wondershare
2014-05-13 13:49 - 2014-05-13 13:49 - 00000000 ____D () C:\Program Files\Common Files\Wondershare
2014-05-13 13:48 - 2014-05-13 13:49 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Wondershare
2014-05-13 13:45 - 2014-05-13 14:12 - 03972841 ____T () C:\Users\Mirko\Desktop\pic_2014-05-20_084056.prn
2014-05-13 13:43 - 2014-05-13 13:46 - 41448432 _____ (Wondershare Software Co.,Ltd. ) C:\Users\Mirko\Downloads\pdf-editor_full1155.exe
2014-05-12 17:50 - 2014-05-20 01:43 - 00002141 _____ () C:\Windows\setupact.log
2014-05-12 17:50 - 2014-05-12 17:50 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-12 14:13 - 2014-05-12 14:13 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_20
2014-05-10 03:05 - 2014-05-10 03:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-08 22:04 - 2014-05-08 22:04 - 06296702 _____ () C:\Users\Mirko\Downloads\recovery-clockwork-6.0.4.5-serranoltexx.tar.zip
2014-05-08 21:50 - 2014-05-08 21:50 - 06301256 _____ () C:\Users\Mirko\Downloads\recovery-clockwork-6.0.4.6-serranoltexx.tar.zip
2014-05-08 21:33 - 2014-05-08 22:32 - 00000000 ____D () C:\Users\Mirko\Downloads\CM
2014-05-08 12:00 - 2014-05-08 12:00 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_01
2014-05-08 09:17 - 2014-05-08 09:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-08 09:16 - 2014-05-08 09:16 - 00851176 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-08 09:15 - 2014-05-08 09:17 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-05-08 09:15 - 2014-05-08 09:15 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-08 09:15 - 2014-05-08 09:15 - 00042592 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-08 09:10 - 2014-05-08 09:16 - 00000000 ____D () C:\usb_driver
2014-05-08 08:46 - 2014-05-08 08:46 - 02056192 _____ () C:\Users\Mirko\Downloads\CMInstaller.msi
2014-05-08 08:45 - 2014-05-08 08:45 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-07 03:12 - 2014-05-07 03:12 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\DropboxMaster
2014-05-06 22:01 - 2014-05-15 19:29 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 14:46 - 2014-05-05 14:46 - 00000000 ____D () C:\ProgramData\Trymedia
2014-05-05 14:44 - 2014-05-05 14:44 - 00001094 _____ () C:\Users\Mirko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall NeoEE Patch.lnk
2014-05-05 14:44 - 2014-05-05 14:44 - 00000771 _____ () C:\Users\Mirko\Desktop\Neo Empire Earth.lnk
2014-05-05 14:44 - 2014-05-05 14:44 - 00000000 __HDC () C:\Users\Mirko\AppData\Local\{2BEF2221-647B-4C7E-B123-4F6ED33FDCAB}
2014-05-05 14:34 - 2014-05-05 14:34 - 00000000 ____D () C:\Users\Mirko\AppData\Local\Save-EE
2014-05-05 14:33 - 2014-05-05 14:34 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Save-EE
2014-05-05 14:26 - 2014-05-05 14:26 - 00001637 _____ () C:\Users\Public\Desktop\Empire Earth.lnk
2014-05-05 14:23 - 2014-05-05 14:30 - 00000403 _____ () C:\Windows\SIERRA.INI
2014-05-05 14:23 - 2014-05-05 14:30 - 00000000 ____D () C:\Sierra
2014-05-05 14:23 - 2014-05-05 14:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sierra
2014-05-05 14:19 - 2013-03-10 21:28 - 00000000 ____D () C:\Users\Mirko\Downloads\EE Complete Deutsch 1.13 by xootle
2014-05-05 14:04 - 2014-05-05 14:18 - 570221502 _____ () C:\Users\Mirko\Downloads\EE Complete Deutsch 1.13 by xootle.exe
2014-05-01 07:21 - 2014-05-01 07:21 - 00000000 __SHD () C:\Users\Mirko\AppData\Local\EmieUserList
2014-05-01 07:21 - 2014-05-01 07:21 - 00000000 __SHD () C:\Users\Mirko\AppData\Local\EmieSiteList
2014-04-29 14:39 - 2014-05-20 04:52 - 00001145 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2014-04-24 05:53 - 2014-04-24 05:53 - 00174862 ____T () C:\Users\Mirko\Desktop\Vertrag Mirko Kraft-1.prn
2014-04-24 04:04 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-24 04:04 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-24 04:04 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-24 04:04 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-24 04:04 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-24 04:04 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-24 04:04 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-24 04:04 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-24 04:04 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-24 04:04 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-24 04:04 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-24 04:04 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-24 04:04 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-24 04:04 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-24 04:04 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-24 04:04 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-24 04:04 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-24 04:04 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-24 04:04 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-24 04:04 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-24 04:04 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-24 04:04 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-24 04:04 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-24 04:03 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-22 14:17 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-22 14:17 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-22 14:17 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-22 14:17 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-22 14:17 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-22 14:17 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-20 07:12 - 2014-05-20 07:12 - 00017408 _____ () C:\Users\Mirko\Downloads\FRST.txt
2014-05-20 07:12 - 2014-05-20 07:12 - 00000000 ____D () C:\FRST
2014-05-20 07:10 - 2014-05-20 07:10 - 01056768 _____ (Farbar) C:\Users\Mirko\Downloads\FRST.exe
2014-05-20 06:51 - 2014-03-07 11:03 - 01253768 _____ () C:\Windows\WindowsUpdate.log
2014-05-20 06:39 - 2013-02-25 00:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 06:15 - 2013-07-26 10:55 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-20 06:09 - 2013-02-13 15:48 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Skype
2014-05-20 05:57 - 2014-01-24 09:52 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001UA.job
2014-05-20 05:12 - 2009-07-14 06:34 - 00020608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 05:12 - 2009-07-14 06:34 - 00020608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 04:52 - 2014-04-29 14:39 - 00001145 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2014-05-20 02:21 - 2013-07-26 10:55 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-20 01:54 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-20 01:50 - 2013-07-08 20:12 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Dropbox
2014-05-20 01:48 - 2013-07-08 20:18 - 00000000 ___RD () C:\Users\Mirko\Dropbox
2014-05-20 01:46 - 2013-12-16 02:50 - 00000000 ____D () C:\Users\Mirko\AppData\Local\LogMeIn Hamachi
2014-05-20 01:43 - 2014-05-12 17:50 - 00002141 _____ () C:\Windows\setupact.log
2014-05-20 01:43 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-19 11:33 - 2014-01-24 09:52 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001Core.job
2014-05-19 03:25 - 2014-05-18 21:35 - 00007607 _____ () C:\Users\Mirko\AppData\Local\Resmon.ResmonCfg
2014-05-18 15:34 - 2014-05-18 15:34 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_24
2014-05-18 15:29 - 2014-05-18 15:27 - 00142984 _____ () C:\Windows\Minidump\051814-196779-01.dmp
2014-05-18 15:27 - 2013-12-09 07:49 - 00000000 ____D () C:\Windows\Minidump
2014-05-18 15:25 - 2014-05-18 15:25 - 325082699 _____ () C:\Windows\MEMORY.DMP
2014-05-18 13:52 - 2013-05-29 12:08 - 00066724 _____ () C:\test.xml
2014-05-18 11:42 - 2013-02-15 13:55 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-16 04:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 22:23 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-15 19:33 - 2014-05-15 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-05-15 19:33 - 2014-05-15 19:33 - 00000000 ____D () C:\Program Files\LogMeIn Hamachi
2014-05-15 19:33 - 2014-02-28 04:05 - 00000896 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-05-15 19:29 - 2014-05-06 22:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 19:29 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-15 14:19 - 2014-05-15 14:19 - 01757326 _____ () C:\Users\Mirko\Downloads\Basisseminar__Mediävistik_1.2_-_Tierfabeln-Dokumente.zip
2014-05-15 14:17 - 2014-05-15 14:43 - 00000472 _____ () C:\Users\Mirko\Desktop\dateiliste.csv
2014-05-15 10:06 - 2014-05-15 09:43 - 02937399 _____ () C:\Users\Mirko\Desktop\Die Passion Christi [Automatisch gespeichert].pptx
2014-05-15 09:38 - 2013-12-04 13:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 09:37 - 2013-07-22 03:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 09:33 - 2014-05-15 09:33 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 09:33 - 2013-02-14 17:24 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 15:59 - 2014-05-14 15:59 - 00829636 _____ () C:\Users\Mirko\Desktop\Die Passion Christi.pptx
2014-05-14 15:59 - 2014-05-14 15:59 - 00000165 ____H () C:\Users\Mirko\Desktop\~$Die Passion Christi.pptx
2014-05-14 14:28 - 2013-02-25 00:22 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-14 14:28 - 2013-02-25 00:22 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-14 13:39 - 2013-07-08 20:16 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-14 05:42 - 2014-05-14 05:42 - 00002770 _____ () C:\Windows\PFRO.log
2014-05-13 14:30 - 2014-05-13 14:26 - 01030808 _____ () C:\Users\Mirko\Desktop\jpdf
2014-05-13 14:12 - 2014-05-13 13:45 - 03972841 ____T () C:\Users\Mirko\Desktop\pic_2014-05-20_084056.prn
2014-05-13 14:10 - 2014-05-13 14:09 - 100225891 ____T () C:\Users\Mirko\Desktop\pic_2014-05-20_084056.ps
2014-05-13 14:06 - 2014-05-13 14:06 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\PDF Architect 2
2014-05-13 14:04 - 2013-08-07 22:07 - 00000000 ____D () C:\Program Files\PokerStars.EU
2014-05-13 14:03 - 2013-08-07 22:07 - 00000000 ____D () C:\Users\Mirko\AppData\Local\PokerStars.EU
2014-05-13 14:02 - 2013-06-16 19:18 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\BitTorrent
2014-05-13 14:01 - 2014-05-13 14:01 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-05-13 13:59 - 2014-05-13 13:58 - 27843432 _____ (pdfforge ) C:\Users\Mirko\Downloads\pdfcreator-1_7_3_setup.exe
2014-05-13 13:58 - 2014-01-02 00:36 - 00000000 ____D () C:\Program Files\Armagetron Advanced
2014-05-13 13:57 - 2014-01-02 00:32 - 00000000 ____D () C:\Program Files\Armagetron Advanced Dedicated
2014-05-13 13:49 - 2014-05-13 13:49 - 00000000 ____D () C:\Users\Mirko\AppData\Local\Wondershare
2014-05-13 13:49 - 2014-05-13 13:49 - 00000000 ____D () C:\Program Files\Common Files\Wondershare
2014-05-13 13:49 - 2014-05-13 13:48 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Wondershare
2014-05-13 13:46 - 2014-05-13 13:43 - 41448432 _____ (Wondershare Software Co.,Ltd. ) C:\Users\Mirko\Downloads\pdf-editor_full1155.exe
2014-05-13 12:30 - 2013-02-25 18:24 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-12 17:50 - 2014-05-12 17:50 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-12 14:13 - 2014-05-12 14:13 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_20
2014-05-11 22:59 - 2013-02-15 21:36 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-10 03:05 - 2014-05-10 03:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 17:37 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 17:37 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-08 22:32 - 2014-05-08 21:33 - 00000000 ____D () C:\Users\Mirko\Downloads\CM
2014-05-08 22:04 - 2014-05-08 22:04 - 06296702 _____ () C:\Users\Mirko\Downloads\recovery-clockwork-6.0.4.5-serranoltexx.tar.zip
2014-05-08 21:50 - 2014-05-08 21:50 - 06301256 _____ () C:\Users\Mirko\Downloads\recovery-clockwork-6.0.4.6-serranoltexx.tar.zip
2014-05-08 12:00 - 2014-05-08 12:00 - 00000000 ____D () C:\Users\Mirko\Desktop\Book2Net_2014_05_01
2014-05-08 09:17 - 2014-05-08 09:17 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-05-08 09:17 - 2014-05-08 09:15 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-05-08 09:16 - 2014-05-08 09:16 - 00851176 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2014-05-08 09:16 - 2014-05-08 09:10 - 00000000 ____D () C:\usb_driver
2014-05-08 09:15 - 2014-05-08 09:15 - 00067680 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\libusb0.dll
2014-05-08 09:15 - 2014-05-08 09:15 - 00042592 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\system32\Drivers\libusb0.sys
2014-05-08 09:15 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-08 08:48 - 2013-02-13 10:34 - 00000000 ____D () C:\Users\Mirko
2014-05-08 08:46 - 2014-05-08 08:46 - 02056192 _____ () C:\Users\Mirko\Downloads\CMInstaller.msi
2014-05-08 08:45 - 2014-05-08 08:45 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2014-05-07 03:12 - 2014-05-07 03:12 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\DropboxMaster
2014-05-06 05:25 - 2014-05-15 09:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-15 09:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-15 09:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 14:46 - 2014-05-05 14:46 - 00000000 ____D () C:\ProgramData\Trymedia
2014-05-05 14:44 - 2014-05-05 14:44 - 00001094 _____ () C:\Users\Mirko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall NeoEE Patch.lnk
2014-05-05 14:44 - 2014-05-05 14:44 - 00000771 _____ () C:\Users\Mirko\Desktop\Neo Empire Earth.lnk
2014-05-05 14:44 - 2014-05-05 14:44 - 00000000 __HDC () C:\Users\Mirko\AppData\Local\{2BEF2221-647B-4C7E-B123-4F6ED33FDCAB}
2014-05-05 14:34 - 2014-05-05 14:34 - 00000000 ____D () C:\Users\Mirko\AppData\Local\Save-EE
2014-05-05 14:34 - 2014-05-05 14:33 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Save-EE
2014-05-05 14:30 - 2014-05-05 14:23 - 00000403 _____ () C:\Windows\SIERRA.INI
2014-05-05 14:30 - 2014-05-05 14:23 - 00000000 ____D () C:\Sierra
2014-05-05 14:30 - 2014-05-05 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sierra
2014-05-05 14:30 - 2013-02-13 04:11 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-05-05 14:27 - 2013-11-27 20:18 - 00000000 ____D () C:\Users\Mirko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-05-05 14:26 - 2014-05-05 14:26 - 00001637 _____ () C:\Users\Public\Desktop\Empire Earth.lnk
2014-05-05 14:18 - 2014-05-05 14:04 - 570221502 _____ () C:\Users\Mirko\Downloads\EE Complete Deutsch 1.13 by xootle.exe
2014-05-04 20:02 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-02 12:45 - 2013-02-13 14:40 - 00000000 ____D () C:\Users\Mirko\Desktop\Bilder
2014-05-01 07:21 - 2014-05-01 07:21 - 00000000 __SHD () C:\Users\Mirko\AppData\Local\EmieUserList
2014-05-01 07:21 - 2014-05-01 07:21 - 00000000 __SHD () C:\Users\Mirko\AppData\Local\EmieSiteList
2014-04-29 22:33 - 2013-02-13 12:52 - 00000000 ____D () C:\Update
2014-04-29 14:39 - 2013-02-13 04:02 - 00000000 ____D () C:\ProgramData\Sony Corporation
2014-04-25 20:17 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-24 05:53 - 2014-04-24 05:53 - 00174862 ____T () C:\Users\Mirko\Desktop\Vertrag Mirko Kraft-1.prn

Files to move or delete:
====================
C:\Users\Mirko\AppData\Roaming\options.ini
C:\Users\Mirko\AppData\Roaming\options_pdfcombine.ini
C:\Users\Mirko\AppData\Roaming\options_pdfrotator.ini
C:\Users\Mirko\AppData\Roaming\setup.ini
C:\Users\Mirko\AppData\Roaming\setup_pdfcombine.ini
C:\Users\Mirko\AppData\Roaming\setup_pdfrotator.ini


Some content of TEMP:
====================
C:\Users\Mirko\AppData\Local\temp\avgnt.exe
C:\Users\Mirko\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpry5ej9.dll
C:\Users\Mirko\AppData\Local\temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 17:37] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-20 05:54

==================== End Of Log ============================
--- --- ---


Addition
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version:17-05-2014
Ran by Mirko at 2014-05-20 07:13:33
Running from C:\Users\Mirko\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Fuel (Version: 2011.0524.2352.41027 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60524.2309 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (Version: 2011.0524.2352.41027 - Ihr Firmenname) Hidden
ArcSoft Magic-i Visual Effects 2 (HKLM\...\{61438020-DDD4-42FA-99A2-50225441980A}) (Version: 2.0.1.142 - ArcSoft)
ArcSoft WebCam Companion 4 (HKLM\...\{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}) (Version: 4.0.21.392 - ArcSoft)
ATI Catalyst Install Manager (HKLM\...\{9F8E6025-423A-2A9F-3951-71E9BE2A85E7}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Bing Bar (HKLM\...\{B4089055-D468-45A4-A6BA-5A138DD715FC}) (Version: 7.0.850.0 - Microsoft Corporation)
Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data (HKLM\...\Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data) (Version:  - )
Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data (HKLM\...\Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data) (Version:  - )
Canon Easy-PhotoPrint Pro (HKLM\...\Easy-PhotoPrint Pro) (Version:  - )
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version:  - )
Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version:  - )
Canon MG6100 series Benutzerregistrierung (HKLM\...\Canon MG6100 series Benutzerregistrierung) (Version:  - )
Canon MG6100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series) (Version:  - )
Canon MP Navigator EX 4.0 (HKLM\...\MP Navigator EX 4.0) (Version:  - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version:  - )
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2011.0524.2352.41027 - ATI) Hidden
Catalyst Control Center InstallProxy (Version: 2011.0524.2352.41027 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2011.0524.2352.41027 - ATI) Hidden
Catalyst Control Center Profiles Mobile (Version: 2011.0524.2352.41027 - ATI) Hidden
CCC Help Chinese Standard (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Czech (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Danish (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Dutch (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help English (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Finnish (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help French (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help German (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Greek (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Hungarian (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Italian (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Japanese (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Korean (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Norwegian (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Polish (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Portuguese (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Russian (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Spanish (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Swedish (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Thai (Version: 2011.0524.2351.41027 - ATI) Hidden
CCC Help Turkish (Version: 2011.0524.2351.41027 - ATI) Hidden
ccc-utility (Version: 2011.0524.2352.41027 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.27 - Piriform)
CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version:  - )
CM Installer (HKLM\...\{E8F42777-958D-4C14-9A42-8DCA1929FD26}) (Version: 1.0.0.0 - Cyanogen Inc.)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
EE-ZDE (HKLM\...\{B49C924C-A651-4378-94F6-5D9BF44A959F}) (Version:  - )
Empire Earth (HKLM\...\{2447500B-22D7-47BD-9B13-1A927F43A267}) (Version:  - )
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free YouTube to MP3 Converter version 3.12.2.426 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.2.426 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.216 - SurfRight B.V.)
Java Auto Updater (Version: 2.0.7.2 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn Hamachi (HKLM\...\LogMeIn Hamachi) (Version: 2.2.0.193 - LogMeIn, Inc.)
LogMeIn Hamachi (Version: 2.2.0.193 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II Trial Version (HKLM\...\Age of Empires II Trial) (Version:  - )
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
NeoEE Patch (HKCU\...\NeoEE Patch) (Version: 2.0.0.2 - NeoEE)
NeoEE Patch (Version: 2.0.0.2 - NeoEE Devlopment) Hidden
OpenVPN 2.3.2-I001  (HKLM\...\OpenVPN) (Version: 2.3.2-I001 - )
Opera 12.15 (HKLM\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
PDFZilla V3.0.0 (HKLM\...\PDFZilla_is1) (Version:  - PDFZilla, Inc.)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PMB (HKLM\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.5.02.12220 - Sony Corporation)
PMB VAIO Edition Plug-in (Version: 1.5.10.05300 - Sony Corporation) Hidden
PMB VAIO Edition Plug-in (Version: 1.6.00.06010 - Sony Corporation) Hidden
PMB VAIO Edition Plug-in (Version: 1.6.00.06140 - Sony Corporation) Hidden
Poczta usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM\...\PokerStars.eu) (Version:  - PokerStars.eu)
Raccolta foto di Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Reader for PC (HKLM\...\{7FAEB610-D6B1-42CE-9EEA-6A5001C2E732}) (Version: 2.1.00.06250 - Sony Corporation)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Remote Keyboard (Version: 1.1.1.03020 - Sony Corporation) Hidden
Remote Play with PlayStation 3 (Version: 1.1.0.15070 - Sony Corporation) Hidden
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SSLx86 (Version: 1.0.0 - Sony Corporation ) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.1.9.0 - Synaptics Incorporated)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
The Panorama Factory V5 m32 Edition (HKLM\...\{27237DBF-81A7-4569-908C-48427460B7BA}) (Version: 5.3.2802 - Smoky City Design)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VAIO - PMB VAIO Edition Plug-in (HKLM\...\InstallShield_{270380EB-8812-42E1-8289-53700DB840D2}) (Version: 1.6.00.06140 - Sony Corporation)
VAIO - Remote Play mit PlayStation®3 (HKLM\...\{07441A52-E208-478A-92B7-5C337CA8C131}) (Version: 1.1.0.15070 - Sony Corporation)
VAIO - Remote-Tastatur  (HKLM\...\{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}) (Version: 1.0.1.03020 - Sony Corporation)
VAIO Care (HKLM\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 6.4.1.05290 - Sony Corporation)
VAIO Care (Version: 6.4.1.05290 - Sony Corporation) Hidden
VAIO Control Center (HKLM\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.5.0.03040 - Sony Corporation)
VAIO Data Restore Tool (HKLM\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.6.0.13140 - Sony Corporation)
VAIO Data Restore Tool (Version: 1.6.0.13140 - Sony Corporation) Hidden
VAIO Easy Connect (HKLM\...\{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}) (Version: 1.0.0.03050 - Sony Corporation)
VAIO Event Service (HKLM\...\{73D8886A-D416-4687-B609-0D3836BA410C}) (Version: 5.5.0.03040 - Sony Corporation)
VAIO Gate (HKLM\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.3.0.11090 - Sony Corporation)
VAIO Gate Default (HKLM\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.4.0.03240 - Sony Corporation)
VAIO Hardware Diagnostics (Version: 4.2.0.14280 - Sony Corporation) Hidden
VAIO Hero Screensaver - Summer 2011 Screensaver (HKLM\...\VAIO Hero Screensaver - Summer 2011 Screensaver) (Version:  - )
VAIO Improvement (HKLM\...\{3A26D9BD-0F73-432D-B522-2BA18138F7EF}) (Version: 1.0.0.14150 - Sony Corporation)
VAIO Improvement Validation (HKLM\...\{17E76DF8-5D02-4C73-B03D-156AD18D3295}) (Version: 1.0.4.01190 - Sony Corporation)
VAIO Sample Contents (HKLM\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.4.2.09010 - Sony Corporation)
VAIO Smart Network (HKLM\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.7.0.07050 - Sony Corporation)
VAIO Update (HKLM\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 6.3.1.10120 - Sony Corporation)
VAIO-Handbuch (HKLM\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 1.3.0.02180 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.4.0.14230 - Sony Corporation)
VCCx86 (Version: 1.0.0 - Sony Corporation) Hidden
VESx86 (Version: 1.0.0 - Sony Corporation) Hidden
VIx86 (Version: 1.0.0 - Sony Corporation) Hidden
VLC media player 2.1.1 (HKLM\...\VLC media player) (Version: 2.1.1 - VideoLAN)
VSNx86 (Version: 1.0.0 - Sony Corporation) Hidden
VU5x86 (Version: 1.1.0 - Sony Corporation ) Hidden
VWSTx86 (Version: 1.0.0 - Sony Corporation) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
Winamp (HKLM\...\Winamp) (Version: 5.63  - Nullsoft, Inc)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Корпорація Майкрософт) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live Messenger (Version: 15.4.3502.0922 - Корпорація Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Συλλογή φωτογραφιών του Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основи Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотоколекція Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

08-05-2014 06:47:03 Installed CM Installer
08-05-2014 06:52:10 Gerätetreiber-Paketinstallation: ClockworkMod SAMSUNG Android Phone
08-05-2014 07:15:51 Gerätetreiber-Paketinstallation: libusb-win32
08-05-2014 07:16:33 Gerätetreiber-Paketinstallation: libusbx.org
09-05-2014 01:00:14 Windows Update
13-05-2014 10:34:02 Windows Update
13-05-2014 12:03:33 Installed PDF Architect 2 View Module
13-05-2014 12:17:29 Removed PDF Architect 2 View Module
15-05-2014 07:26:04 Windows Modules Installer
18-05-2014 11:45:55 VAIO Care Automatic Restore Point
19-05-2014 21:17:50 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-02-20 21:52 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1DB8E6C9-D79B-4975-9438-DA44D7B57E4E} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-02-15] (Sony Corporation)
Task: {275D7994-A286-4828-86FA-D7539131A931} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-01-23] (Piriform Ltd)
Task: {54DED071-13F0-4348-B00C-2AEC7FD736F4} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-09-19] (Sony Corporation)
Task: {6DBDC224-9375-4256-9940-1FC8A32E2610} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-09-27] (Sony Corporation)
Task: {72F7A25C-C55C-434C-AAC1-6DEE6967CAC8} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {867D3160-2599-4F04-955F-E7002A64D54B} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient
Task: {969A62D0-D794-4F15-9B81-D06C4D02557B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001Core => C:\Users\Mirko\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-24] (Facebook Inc.)
Task: {97BF84BD-2E2B-4AD6-9CCE-F9E211D7F23C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-26] (Google Inc.)
Task: {9FAA6F3F-5D20-49C8-BE8A-AACBE8C9EFCF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-26] (Google Inc.)
Task: {AB899A36-0583-47C9-8000-8F63B5AA510A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001UA => C:\Users\Mirko\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-24] (Facebook Inc.)
Task: {B0DACCF4-0C40-4BF2-99A5-697AAE4944A8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {B2E9FA24-6941-42DD-ABEB-693014111962} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation)
Task: {C595D33B-62F2-4F14-BC9C-1816B7C34AF1} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: {C7093D95-4EC7-4613-AAF5-6588D73CCE88} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {DC73FAD4-3DAD-4E2C-AE52-D39B52E48908} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {EB3E8066-BF8C-4299-A5B0-6AB472306A56} - System32\Tasks\TunnelBear => C:\Program Files\TunnelBear\TunnelBear.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001Core.job => C:\Users\Mirko\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2837224145-4290876003-1718813567-1001UA.job => C:\Users\Mirko\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-02-13 10:50 - 2013-02-13 10:47 - 00397704 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2011-05-25 00:17 - 2011-05-25 00:17 - 00065024 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-06-25 19:23 - 2013-06-25 19:23 - 00880640 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\fsk.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00040264 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00239944 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\Fskin.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00026952 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2013-05-23 20:54 - 2013-05-23 20:54 - 00798720 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00125256 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00016200 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskPower.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00024904 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00017224 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00015176 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00034632 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ticket.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00018760 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00092488 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00149832 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2013-06-25 19:24 - 2013-06-25 19:24 - 00178504 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\USBDetector.dll
2013-02-13 04:27 - 2011-03-05 17:42 - 00013824 _____ () C:\Program Files\Sony\VAIO Event Service\VESBasePS.dll
2011-05-25 00:17 - 2011-05-25 00:17 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-03-14 15:21 - 2011-03-14 15:21 - 00016384 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-05-25 00:50 - 2011-05-25 00:50 - 00243712 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00245760 _____ () C:\Program Files\Sony\VAIO Care\CRM\ManagedVAIORecoveryMedia.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00147456 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIORecovery.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00051200 _____ () C:\Program Files\Sony\VAIO Care\CRM\Logging.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00053760 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOCommon.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00162816 _____ () C:\Program Files\Sony\VAIO Care\CRM\OsServices.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00033792 _____ () C:\Program Files\Sony\VAIO Care\CRM\PluginFactory.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00214528 _____ () C:\Program Files\Sony\VAIO Care\CRM\RecoveryPartitionManager.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00034304 _____ () C:\Program Files\Sony\VAIO Care\CRM\XMLTools.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00047616 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOInstallAppsDrivers.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00117760 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallDB.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00108544 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallationTools.dll
2013-02-13 05:28 - 2011-02-25 18:14 - 00021504 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOUtility.dll
2014-05-10 03:05 - 2014-05-10 03:05 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/20/2014 04:07:40 AM) (Source: Windows Search Service) (EventID: 3100) (User: )
Description: Der Filterhostprozess kann nicht initialisiert werden. Der Vorgang wird abgebrochen.


Details:
	Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben.  (HRESULT : 0x800705b4) (0x800705b4)

Error: (05/20/2014 01:46:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/19/2014 11:59:21 PM) (Source: Google Update) (EventID: 20) (User: Mirko-VAIO)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7

Error: (05/19/2014 11:27:50 PM) (Source: System Restore) (EventID: 8200) (User: )
Description: Fehler beim Initiieren der Systemwiederherstellung (VAIO Care Automatic Restore Point).

Error: (05/19/2014 11:12:41 PM) (Source: Google Update) (EventID: 20) (User: Mirko-VAIO)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7

Error: (05/19/2014 00:08:17 PM) (Source: Google Update) (EventID: 20) (User: Mirko-VAIO)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7

Error: (05/19/2014 11:35:32 AM) (Source: Google Update) (EventID: 20) (User: Mirko-VAIO)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7

Error: (05/19/2014 05:59:20 AM) (Source: Google Update) (EventID: 20) (User: Mirko-VAIO)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7

Error: (05/19/2014 03:50:28 AM) (Source: System Restore) (EventID: 8200) (User: )
Description: Fehler beim Initiieren der Systemwiederherstellung (VAIO Care Automatic Restore Point).

Error: (05/19/2014 03:12:45 AM) (Source: System Restore) (EventID: 8204) (User: )
Description: Die Systemwiederherstellung wurde wegen eines Stromausfalls oder eines Programmfehlers unerwartet beendet. Zusätzliche Informationen: (Windows Update).


System errors:
=============
Error: (05/20/2014 06:39:45 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (05/20/2014 06:39:45 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (05/20/2014 06:39:45 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (05/20/2014 06:39:42 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (05/20/2014 06:39:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (05/20/2014 06:39:42 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (05/20/2014 06:39:39 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (05/20/2014 06:39:39 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (05/20/2014 06:39:39 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (05/20/2014 06:39:39 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 42%
Total physical RAM: 3578.9 MB
Available physical RAM: 2070.02 MB
Total Pagefile: 7156.09 MB
Available Pagefile: 5185.2 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.08 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:453.5 GB) (Free:370.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F94264A0)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)

==================== End Of Log ============================
__________________
Alt 20.05.2014, 12:39   #4
schrauber
/// the machine
/// TB-Ausbilder
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


Warum muss ich mich immer wiederholen?

Zitat:
Zitat von schrauber
vollen Pfad zum Fund von Avira?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 20.05.2014, 13:47   #5
trampeltier
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


Sorry :/

In der Datei 'C:\Sierra\Empire Earth\Empire Earth.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\Windows\System32\control.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern


Alt 21.05.2014, 07:54   #6
schrauber
/// the machine
/// TB-Ausbilder
 
TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Standard

TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


Beide Dateien bitte bei www.virustotal.com scannen lassen.
__________________
--> TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt

Antwort

Themen zu TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt
abgesicherten, antivir, beschädigt, beste grüße, betriebssystem, computer, datei, ebenfalls, festplatte, files, folge, guten, kaputt, langsamer, laptop, meldung, modus, programm, retten, screenshot, sonntag, starten, systemwiederherstellung, trojaner, win7, zugriff


« Pc spinnt Browser lassen sich nicht öffnen | workstation setup - with wfp funktioniert nicht mehr »


Ähnliche Themen: TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt


  1. Mehrfaches aufhängen vom PC! Festplatte kaputt oder Virus?
    Plagegeister aller Art und deren Bekämpfung - 04.10.2015 (3)
  2. Festplatte kaputt oder Fehler beim Neuaufsetzen?
    Netzwerk und Hardware - 24.01.2015 (10)
  3. TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 03.01.2013 (5)
  4. TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 19.12.2012 (9)
  5. TR/Crypt.EPACK.Gen2 auf dem pc
    Plagegeister aller Art und deren Bekämpfung - 19.12.2012 (7)
  6. TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 13.12.2012 (6)
  7. appConf32.exe Trojaner TR/Crypt.EPACK.Gen2 wie entfernen?
    Plagegeister aller Art und deren Bekämpfung - 27.11.2012 (3)
  8. TR/Crypt.EPACK.Gen2
    Log-Analyse und Auswertung - 06.11.2012 (18)
  9. TR/Crypt.EPACK.Gen2 - Trojaner
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (2)
  10. TR/Crypt.EPACK.Gen2 Trojaner entfernen
    Plagegeister aller Art und deren Bekämpfung - 11.08.2012 (6)
  11. Trojaner(?): Festplatte angeblich kaputt, Desktop ist schwarz, Startmenü leer
    Plagegeister aller Art und deren Bekämpfung - 03.08.2012 (14)
  12. RAM Kaputt, oder Trojaner?
    Netzwerk und Hardware - 26.07.2012 (3)
  13. TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 15.12.2011 (17)
  14. Trojaner TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 24.06.2011 (34)
  15. TR/Crypt.EPACK.Gen2 Antivir zeigt mir ständig Diesen Trojaner an--> Nicht löschbar
    Plagegeister aller Art und deren Bekämpfung - 06.04.2011 (10)
  16. TR/Crypt.EPACK.Gen2
    Plagegeister aller Art und deren Bekämpfung - 12.01.2011 (10)
  17. Problem mit Trojaner tr crypt.epack.gen2
    Plagegeister aller Art und deren Bekämpfung - 14.11.2010 (9)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt - Guten Morgen! Vor 3-4 Tagen wurde mein Laptop ein wenig langsamer, bis es am Sonntag auf einmal unerträglich wurde. Ich wollte zu erst eine Systemwiederherstellung durchführen, was jedoch nicht möglich - TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt...
Archiv
Du betrachtest: TR7Crypt.EPACK.Gen2 Trojaner und/oder Festplatte kaputt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19