"Browse to save" Virus

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by torsten.schaff (administrator) on WSSG131 on 23-06-2014 15:17:32
Running from C:\Users\torsten.schaff\Downloads
Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(SMSC) C:\Program Files\SGFX\sgfxmgr.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Gobi\QDLService\GobiQDLService.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL11.NAVDEMO\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Telefónica I+D) C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe
() C:\Program Files (x86)\ZyXEL\ZyWALL SecuExtender\SecuExtenderHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Citrix Systems, Inc.) C:\Citrix\ssonsvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(C4B Com For Business AG) C:\Program Files (x86)\Common Files\C4B\Server\XPLogonUM.exe
() C:\Autohotkey\AutoHotkey.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Google) C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe
(Citrix Systems, Inc.) C:\Citrix\concentr.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
() C:\Program Files (x86)\Alpha Solutions\Quick Starter\Starter.exe
(Citrix Systems, Inc.) C:\Citrix\pnamain.exe
() C:\Program Files\SGFX\SgfxConfig.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\TscHelp.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagPriv.exe
(Citrix Systems, Inc.) C:\Citrix\wfcrun32.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\NAV\7.00.00\35391\RTC\Microsoft.Dynamics.Nav.Client.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Dynamics NAV\71\Service\Microsoft.Dynamics.Nav.Server.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Microsoft Corporation) C:\NAV\7.01.00\36310\RTC\Microsoft.Dynamics.Nav.Client.exe
(Citrix Systems, Inc.) C:\Citrix\wfica32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-02-01] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2013-02-01] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636072 2012-10-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-01-31] ()
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [290688 2013-02-01] (Intel Corporation)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [334240 2012-09-12] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2013-02-01] (Intel Corporation)
HKLM-x32\...\Run: [Communicator] => C:\Program Files (x86)\Microsoft Office Communicator\communicator.exe [5164712 2013-04-10] (Microsoft Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Citrix\concentr.exe [362432 2011-12-22] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [581496 2012-09-24] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [SgfxConfig] => C:\Program Files\SGFX\sgfxconfig.exe [2230848 2012-04-30] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\Run: [XPhone] => C:\Program Files (x86)\XPhone30\XPhone.exe [6045825 2009-08-11] (C4B Com For Business AG)
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\Run: [LiveSupport] => C:\Program Files (x86)\LiveSupport\LiveSupport.exe [1005056 2014-03-18] (PC Utilities Software Limited)
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\MountPoints2: {9cde3c75-79fe-11e2-b8eb-7ce9d3eb77ce} - G:\LGAutoRun.exe
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\MountPoints2: {ad410d30-c53b-11e2-bc96-00a0c6000000} - F:\AutoRun.exe
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\MountPoints2: {ad410d3e-c53b-11e2-bc96-00a0c6000000} - F:\AutoRun.exe
HKU\S-1-5-21-865199144-4156096860-3413541663-3579\...\MountPoints2: {ad410d6c-c53b-11e2-bc96-00a0c6000000} - F:\AutoRun.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\admin.sac\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoHotkey.lnk
ShortcutTarget: AutoHotkey.lnk -> C:\Autohotkey\AutoHotkey.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Calendar Sync.lnk
ShortcutTarget: Google Calendar Sync.lnk -> C:\Program Files (x86)\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HABEL Profile Setup.lnk
ShortcutTarget: HABEL Profile Setup.lnk -> \\srvdms01\Habel\gedosod\32-bit\HpHab854.exe (HABEL Dokumentenmanagement GmbH)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Receiver.lnk
ShortcutTarget: Receiver.lnk -> C:\Windows\Installer\{38409AC9-F0FD-4323-A98F-881D8EF338C4}\pnaico.exe.20FBBF0A_A7E5_4BDE_9798_9811C3D135AC.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk
ShortcutTarget: SnagIt 8.lnk -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe (TechSmith Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Starter.lnk
ShortcutTarget: Starter.lnk -> C:\Program Files (x86)\Alpha Solutions\Quick Starter\Starter.exe ()
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Schweiz : Hotmail, Outlook, Skype download, Unterhaltung, Nachrichten, Sport, Lifestyle, Auto und mehr bei MSN CH
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x12BCF02D1A86CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://my.alpha-solutions.ch/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = Search
SearchScopes: HKLM-x32 - DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastosearch.info/?l=1&q={searchTerms}&pid=1924&r=2014/06/05&hid=11941922099118838850&lg=EN&cc=CH&unqvl=55
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastosearch.info/?l=1&q={searchTerms}&pid=1924&r=2014/06/05&hid=11941922099118838850&lg=EN&cc=CH&unqvl=55
SearchScopes: HKCU - DefaultScope {5FDC5A1C-C45A-4EC8-A2A3-BD3C6E23B836} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=120307&babsrc=SP_ss&mntrId=04b2b8590000000000007ce9d3eb77ce
SearchScopes: HKCU - {5FDC5A1C-C45A-4EC8-A2A3-BD3C6E23B836} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.fastosearch.info/?l=1&q={searchTerms}&pid=1924&r=2014/06/05&hid=11941922099118838850&lg=EN&cc=CH&unqvl=55
BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 8\DLLx64\SnagItBHO64.dll (TechSmith Corporation)
BHO: ssave On - {4EBBEF05-49DB-AFF8-EC0E-B8B3C20C5438} - C:\Program Files (x86)\ssave On\mx7j5PqaSr.x64.dll ()
BHO: seave on - {58296CF3-A95A-1EE3-021A-5806126B0DA4} - C:\Program Files (x86)\seave on\qMRa.x64.dll ()
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: SNT - {AB575EAA-E887-FE90-9E06-6945CE84F1FE} - C:\Program Files (x86)\SNT\q9.x64.dll ()
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: saave. On - {E78781CD-D06A-B6AE-2234-9AD3E2599685} - C:\Program Files (x86)\saave. On\ptF.x64.dll ()
BHO-x32: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll (TechSmith Corporation)
BHO-x32: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.11.10\bh\BabylonToolbar.dll (Babylon BHO)
BHO-x32: ssave On - {4EBBEF05-49DB-AFF8-EC0E-B8B3C20C5438} - C:\Program Files (x86)\ssave On\mx7j5PqaSr.dll ()
BHO-x32: seave on - {58296CF3-A95A-1EE3-021A-5806126B0DA4} - C:\Program Files (x86)\seave on\qMRa.dll ()
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: SNT - {AB575EAA-E887-FE90-9E06-6945CE84F1FE} - C:\Program Files (x86)\SNT\q9.dll ()
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: saave. On - {E78781CD-D06A-B6AE-2234-9AD3E2599685} - C:\Program Files (x86)\saave. On\ptF.dll ()
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.11.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  No File
DPF: HKLM-x32 {44C1E3A2-B594-401C-B27A-D1B4476E4797} https://gate.snv.ch/XTSAC.cab
DPF: HKLM-x32 {5B84B165-F6DE-4126-B3F8-5EDCD447EFF4} https://213.196.186.5/ext-js/web-pages/portal/SecuExtender.cab
DPF: HKLM-x32 {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
DPF: HKLM-x32 {8D9563A9-8D5F-459B-87F2-BA842255CB9A} https://my.alpha-solutions.ch/InternalSite/WhlCompMgr.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Citrix\IcaMimeFilter.dll (Citrix Systems, Inc.)
Winsock: Catalog5 08 C:\PROGRA~1\MICROS~4\ENDPOI~1\318FB7~1.0\WhlNSP.dll [143760] (Microsoft Corporation)
Winsock: Catalog9 01 C:\PROGRA~1\MICROS~4\ENDPOI~1\318FB7~1.0\WhlLSP.dll [182672] (Microsoft Corporation)
Winsock: Catalog9 02 C:\PROGRA~1\MICROS~4\ENDPOI~1\318FB7~1.0\WhlLSP.dll [182672] (Microsoft Corporation)
Winsock: Catalog9 03 C:\PROGRA~1\MICROS~4\ENDPOI~1\318FB7~1.0\WhlLSP.dll [182672] (Microsoft Corporation)
Winsock: Catalog9 15 C:\PROGRA~1\MICROS~4\ENDPOI~1\318FB7~1.0\WhlLSP.dll [182672] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 10.220.0.12 10.220.0.10
Tcpip\..\Interfaces\{EC0AC0F9-FD83-4DF6-ABFC-0C36057D4352}: [NameServer]10.220.0.10 10.220.0.12

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @Citrix.com/npican - C:\Citrix\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393080 2012-09-24] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-24] (BlueStack Systems, Inc.)
S3 DMService; C:\Windows\Downloaded Program Files\DMService.exe [487312 2013-02-18] (Microsoft Corporation)
R2 GobiQDLService; C:\Program Files (x86)\Sierra Wireless Inc\Gobi\QDLService\GobiQDLService.exe [312688 2011-11-26] (Sierra Wireless, Inc.)
R2 hasplms; C:\Windows\system32\hasplms.exe [4180576 2010-09-27] (SafeNet Inc.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [523680 2012-09-12] (Hewlett-Packard Company)
S3 MicrosoftDynamicsNavServer; C:\Program Files (x86)\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [141184 2010-12-11] (Microsoft Corporation)
R2 MicrosoftDynamicsNavServer$DynamicsNAV71; C:\Program Files\Microsoft Dynamics NAV\71\Service\Microsoft.Dynamics.Nav.Server.exe [112320 2014-03-19] (Microsoft Corporation)
S3 MicrosoftDynamicsNavVSS; C:\Program Files\Microsoft Dynamics NAV\71\Service\Microsoft.Dynamics.Nav.Server.VSSWriterService.exe [16616 2014-03-19] (Microsoft Corporation)
S3 MicrosoftDynamicsNavWS; C:\Program Files (x86)\Microsoft Dynamics NAV\60\Service\Microsoft.Dynamics.Nav.Server.exe [141184 2010-12-11] (Microsoft Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R2 MSSQL$NAVDEMO; c:\Program Files\Microsoft SQL Server\MSSQL11.NAVDEMO\MSSQL\Binn\sqlservr.exe [192000 2012-12-29] (Microsoft Corporation)
R2 MSSQLSERVER; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-02-08] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S3 PEERNET Spooler Service 9.0; C:\Windows\system32\spool\DRIVERS\x64\3\PNSvc9.exe [225096 2012-03-19] (PEERNET Inc.)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-02-08] (Hewlett-Packard) [File not signed]
R2 SGFXMgr; C:\Program Files\SGFX\sgfxmgr.exe [5715968 2012-04-27] (SMSC) [File not signed]
S4 SQLAgent$NAVDEMO; c:\Program Files\Microsoft SQL Server\MSSQL11.NAVDEMO\MSSQL\Binn\SQLAGENT.EXE [612864 2012-12-29] (Microsoft Corporation)
R2 TGCM_ImportWiFiSvc; C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)
R2 uagqecsvc; C:\Program Files\Microsoft Forefront UAG\Endpoint Components\3.1.0\uagqecsvc.exe [150928 2010-11-25] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
R2 ZyWALL SecuExtender Helper; C:\Program Files (x86)\ZyXEL\ZyWALL SecuExtender\SecuExtenderHelper.exe [28536 2010-01-15] ()
S2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [X]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [X]
S2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [X]
S2 ZeroConfigService; "C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Google Inc)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2013-02-01] (Broadcom Corporation.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [71032 2012-09-24] (BlueStack Systems)
S3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2013-02-01] (Broadcom Corporation.)
R2 CoSslvpn; C:\Windows\System32\DRIVERS\secuextender64.sys [63808 2010-01-15] ()
S3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [187264 2013-08-19] (HID Global Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331208 2013-01-14] (SafeNet Inc.)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-02-01] (JMicron Technology Corp.)
S3 LAN9500; C:\Windows\System32\DRIVERS\lan9500-x64-n620f.sys [76288 2012-11-02] (SMSC)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
S4 RsFx0201; C:\Windows\System32\DRIVERS\RsFx0201.sys [336880 2012-10-20] (Microsoft Corporation)
R4 sgfxk; C:\Windows\System32\drivers\sgfxk64.sys [141888 2012-05-01] (SMSC)
R0 sgfxl; C:\Windows\System32\drivers\sgfxl64.sys [14912 2012-05-01] (SMSC)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
R3 swg3kmbb02; C:\Windows\System32\DRIVERS\swg3kmbb02.sys [458752 2011-11-10] (Sierra Wireless Incorporated)
R3 swg3knmea02; C:\Windows\System32\DRIVERS\swg3knmea02.sys [259200 2011-08-18] (Sierra Wireless Incorporated)
R3 swg3kser02; C:\Windows\System32\DRIVERS\swg3kser02.sys [259200 2011-08-18] (Sierra Wireless Incorporated)
R3 swibus02; C:\Windows\System32\DRIVERS\swibus02.sys [74752 2011-08-18] (Sierra Wireless Inc.)
R3 swibusflt02; C:\Windows\System32\DRIVERS\swibusflt02.sys [74752 2011-08-18] (Sierra Wireless Inc.)
S1 cmurxrke; \??\C:\Windows\system32\drivers\cmurxrke.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-23 15:17 - 2014-06-23 15:17 - 02082816 _____ (Farbar) C:\Users\torsten.schaff\Downloads\FRST64.exe
2014-06-23 15:17 - 2014-06-23 15:17 - 00030542 _____ () C:\Users\torsten.schaff\Downloads\FRST.txt
2014-06-23 15:17 - 2014-06-23 15:17 - 00000000 ____D () C:\FRST
2014-06-23 14:47 - 2014-06-23 14:47 - 00000000 ____D () C:\Program Files (x86)\AllSaver
2014-06-23 07:06 - 2014-06-23 07:06 - 00001701 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Office Communicator 2007.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001701 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Outlook Aktivierung.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001699 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jet Reports aktivieren.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001687 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001681 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Recherche.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001681 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Postkorb.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001677 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALPHA LIVE ALT.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001677 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alpha Desktop.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001673 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Creator.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001669 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SnagIT 8.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001669 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALPHA LIVE.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Support
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Office
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NavisionTools
2014-06-20 11:09 - 2014-06-20 11:09 - 11827250 _____ () C:\Users\torsten.schaff\Desktop\80259A_NA2009_ENUS_WM.zip
2014-06-18 10:59 - 2014-06-18 10:59 - 07488130 _____ () C:\Users\torsten.schaff\Desktop\80041_NA2009SP1_ENBE_FIN_EXT.zip
2014-06-18 10:57 - 2014-06-18 10:57 - 11125467 _____ () C:\Users\torsten.schaff\Desktop\80041A_NA2009_ENUS_FIN.zip
2014-06-18 10:50 - 2014-06-18 10:50 - 00000000 ____D () C:\Program Files (x86)\BestSaaveForYouu
2014-06-12 16:43 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-12 16:43 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-12 16:43 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 16:43 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 16:43 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 16:43 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 16:43 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 16:43 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 16:43 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 16:43 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 16:43 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 16:43 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 16:43 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 16:43 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-12 16:42 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 16:42 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-12 16:41 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 16:41 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 16:41 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 16:41 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 16:41 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 16:41 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 16:41 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 16:41 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 16:41 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 16:41 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 16:41 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 16:41 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 16:41 - 2014-05-24 02:13 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-06-12 16:41 - 2014-05-24 02:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-06-12 09:14 - 2014-06-12 09:14 - 00131072 _____ () C:\Users\torsten.schaff\Desktop\ECDE WM-Tipp_2014.xls
2014-06-12 08:13 - 2014-06-12 08:13 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Local\Adobe
2014-06-06 14:18 - 2014-06-06 14:19 - 00000000 ____D () C:\Users\torsten.schaff\Desktop\NA2009_DEDE_INM
2014-06-05 11:47 - 2014-06-05 11:47 - 00001270 _____ () C:\Users\Public\Desktop\NiceLabel Standard.lnk
2014-06-05 11:46 - 2014-06-05 11:47 - 00000000 ___HD () C:\ProgramData\{953DA5FD-EBF1-461E-9814-E6007641C748}
2014-06-05 11:46 - 2014-06-05 11:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NiceLabel Designer Standard 6
2014-06-05 11:46 - 2014-06-05 11:46 - 00000000 ____D () C:\Program Files (x86)\EuroPlus
2014-06-05 11:40 - 2014-06-18 10:51 - 00000000 ____D () C:\Program Files (x86)\save  on
2014-06-05 11:40 - 2014-06-05 11:40 - 00000000 ____D () C:\Program Files (x86)\seave on
2014-06-05 11:36 - 2014-06-05 11:36 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\EZDownloader
2014-06-05 11:33 - 2014-06-23 14:51 - 00000000 ____D () C:\Program Files (x86)\SNT
2014-06-05 11:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\SkypEmoticons
2014-06-05 11:33 - 2014-06-05 11:33 - 00001139 _____ () C:\Users\torsten.schaff\Desktop\LiveSupport.lnk
2014-06-05 11:33 - 2014-06-05 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiveSupport
2014-06-05 11:33 - 2014-06-05 11:33 - 00000000 ____D () C:\Program Files (x86)\LiveSupport
2014-06-05 11:32 - 2014-06-23 14:51 - 00000000 ____D () C:\ProgramData\ae74235a72fcff7f
2014-06-05 11:32 - 2014-06-19 06:51 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-06-05 11:32 - 2014-06-18 16:43 - 00000000 ____D () C:\Program Files (x86)\YoutubeAdblocker
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Local\Packages
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Program Files (x86)\ssave On
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Program Files (x86)\saave. On
2014-06-04 10:23 - 2014-06-04 10:23 - 00019830 _____ () C:\Users\torsten.schaff\Documents\Fakturavorschau 05_2014 she.xlsx
2014-06-02 18:18 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-02 18:18 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-02 18:16 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-06-02 18:16 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-06-02 18:16 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-06-02 18:16 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-06-02 18:16 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-06-02 18:16 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-06-02 18:16 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-06-02 18:16 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-02 18:16 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-02 18:16 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-02 18:16 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-06-02 18:16 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-06-02 18:16 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-06-02 18:16 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-06-02 18:16 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-02 18:16 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-02 18:16 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-02 18:16 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-02 18:16 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

==================== One Month Modified Files and Folders =======

2014-06-23 15:17 - 2014-06-23 15:17 - 02082816 _____ (Farbar) C:\Users\torsten.schaff\Downloads\FRST64.exe
2014-06-23 15:17 - 2014-06-23 15:17 - 00030542 _____ () C:\Users\torsten.schaff\Downloads\FRST.txt
2014-06-23 15:17 - 2014-06-23 15:17 - 00000000 ____D () C:\FRST
2014-06-23 14:56 - 2013-02-01 10:06 - 01427943 _____ () C:\Windows\WindowsUpdate.log
2014-06-23 14:51 - 2014-06-05 11:33 - 00000000 ____D () C:\Program Files (x86)\SNT
2014-06-23 14:51 - 2014-06-05 11:32 - 00000000 ____D () C:\ProgramData\ae74235a72fcff7f
2014-06-23 14:47 - 2014-06-23 14:47 - 00000000 ____D () C:\Program Files (x86)\AllSaver
2014-06-23 14:46 - 2013-02-05 16:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-23 13:45 - 2013-02-11 18:45 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\XPhone30
2014-06-23 13:43 - 2009-07-14 06:45 - 00015680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-23 13:43 - 2009-07-14 06:45 - 00015680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-23 13:41 - 2009-07-14 12:49 - 00907780 _____ () C:\Windows\system32\perfh007.dat
2014-06-23 13:41 - 2009-07-14 12:49 - 00229466 _____ () C:\Windows\system32\perfc007.dat
2014-06-23 13:41 - 2009-07-14 07:13 - 02190780 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-23 13:37 - 2014-04-03 10:54 - 00001818 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Fernwartungs-VDI.lnk
2014-06-23 13:37 - 2013-02-11 18:33 - 00000000 ____D () C:\Users\torsten.schaff\Tracing
2014-06-23 13:36 - 2014-02-04 19:04 - 00032068 _____ () C:\SecuExtenderHelper.log
2014-06-23 13:36 - 2013-02-05 14:54 - 00000136 _____ () C:\Windows\system32\config\netlogon.ftl
2014-06-23 13:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-23 13:36 - 2009-07-14 06:51 - 00077703 _____ () C:\Windows\setupact.log
2014-06-23 10:31 - 2013-02-05 15:02 - 00016018 __RSH () C:\ProgramData\ntuser.pol
2014-06-23 07:06 - 2014-06-23 07:06 - 00001701 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Office Communicator 2007.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001701 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Outlook Aktivierung.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001699 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jet Reports aktivieren.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001687 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001681 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Recherche.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001681 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Habel Postkorb.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001677 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALPHA LIVE ALT.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001677 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alpha Desktop.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001673 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Creator.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001669 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SnagIT 8.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00001669 _____ () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALPHA LIVE.lnk
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Support
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Office
2014-06-23 07:06 - 2014-06-23 07:06 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NavisionTools
2014-06-20 11:09 - 2014-06-20 11:09 - 11827250 _____ () C:\Users\torsten.schaff\Desktop\80259A_NA2009_ENUS_WM.zip
2014-06-20 09:49 - 2014-03-31 17:22 - 00001818 _____ () C:\Users\torsten.schaff\Desktop\Fernwartungs-VDI.lnk
2014-06-20 09:49 - 2013-07-04 09:49 - 00002759 _____ () C:\Users\torsten.schaff\Desktop\20130522 Pendenzenliste she.xls - Verknüpfung.lnk
2014-06-20 07:50 - 2014-04-10 09:13 - 00000000 ____D () C:\Users\torsten.schaff\Desktop\ECLU
2014-06-19 16:05 - 2013-02-12 11:44 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\Skype
2014-06-19 15:38 - 2014-04-16 16:38 - 00032768 _____ () C:\Users\torsten.schaff\AppData\Roaming\EMS_LU_6_00_10_BE.zup
2014-06-19 06:51 - 2014-06-05 11:32 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-06-18 16:43 - 2014-06-05 11:32 - 00000000 ____D () C:\Program Files (x86)\YoutubeAdblocker
2014-06-18 10:59 - 2014-06-18 10:59 - 07488130 _____ () C:\Users\torsten.schaff\Desktop\80041_NA2009SP1_ENBE_FIN_EXT.zip
2014-06-18 10:57 - 2014-06-18 10:57 - 11125467 _____ () C:\Users\torsten.schaff\Desktop\80041A_NA2009_ENUS_FIN.zip
2014-06-18 10:51 - 2014-06-05 11:40 - 00000000 ____D () C:\Program Files (x86)\save  on
2014-06-18 10:50 - 2014-06-18 10:50 - 00000000 ____D () C:\Program Files (x86)\BestSaaveForYouu
2014-06-17 09:08 - 2013-12-04 13:06 - 00000000 ____D () C:\Users\torsten.schaff\Desktop\Kägi
2014-06-16 12:42 - 2013-02-12 14:22 - 00262144 _____ () C:\Users\torsten.schaff\AppData\Roaming\SNV_4_00_01_CH.zup
2014-06-13 07:05 - 2014-04-23 17:05 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-12 16:45 - 2013-08-14 17:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 16:44 - 2013-02-01 15:29 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 16:43 - 2013-02-05 15:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 09:14 - 2014-06-12 09:14 - 00131072 _____ () C:\Users\torsten.schaff\Desktop\ECDE WM-Tipp_2014.xls
2014-06-12 08:13 - 2014-06-12 08:13 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Local\Adobe
2014-06-12 07:01 - 2013-02-05 16:34 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-12 07:01 - 2013-02-05 16:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-12 07:01 - 2013-02-05 16:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-12 07:00 - 2013-02-11 18:33 - 00049494 __RSH () C:\Users\torsten.schaff\ntuser.pol
2014-06-12 07:00 - 2013-02-11 18:33 - 00000000 ____D () C:\Users\torsten.schaff
2014-06-08 11:13 - 2014-06-12 16:42 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 16:42 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 16:32 - 2014-05-13 10:29 - 00032768 _____ () C:\Users\torsten.schaff\AppData\Roaming\KAGI_SOHNE_AG_7_01_00_CH.zup
2014-06-06 14:19 - 2014-06-06 14:18 - 00000000 ____D () C:\Users\torsten.schaff\Desktop\NA2009_DEDE_INM
2014-06-06 12:33 - 2014-06-05 11:33 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\SkypEmoticons
2014-06-06 07:02 - 2013-02-01 16:22 - 00458720 _____ () C:\Windows\PFRO.log
2014-06-05 11:47 - 2014-06-05 11:47 - 00001270 _____ () C:\Users\Public\Desktop\NiceLabel Standard.lnk
2014-06-05 11:47 - 2014-06-05 11:46 - 00000000 ___HD () C:\ProgramData\{953DA5FD-EBF1-461E-9814-E6007641C748}
2014-06-05 11:47 - 2014-06-05 11:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NiceLabel Designer Standard 6
2014-06-05 11:47 - 2013-03-27 14:30 - 00103140 _____ () C:\Windows\aksdrvsetup.log
2014-06-05 11:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Setup
2014-06-05 11:46 - 2014-06-05 11:46 - 00000000 ____D () C:\Program Files (x86)\EuroPlus
2014-06-05 11:46 - 2013-03-27 14:30 - 00000000 ____D () C:\ProgramData\EuroPlus
2014-06-05 11:40 - 2014-06-05 11:40 - 00000000 ____D () C:\Program Files (x86)\seave on
2014-06-05 11:38 - 2014-05-09 08:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zebra Technologies
2014-06-05 11:36 - 2014-06-05 11:36 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Roaming\EZDownloader
2014-06-05 11:33 - 2014-06-05 11:33 - 00001139 _____ () C:\Users\torsten.schaff\Desktop\LiveSupport.lnk
2014-06-05 11:33 - 2014-06-05 11:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiveSupport
2014-06-05 11:33 - 2014-06-05 11:33 - 00000000 ____D () C:\Program Files (x86)\LiveSupport
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\torsten.schaff\AppData\Local\Packages
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Gast
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\alphaadmin\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Administrator
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Torch
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\Chromatic Browser
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Program Files (x86)\ssave On
2014-06-05 11:32 - 2014-06-05 11:32 - 00000000 ____D () C:\Program Files (x86)\saave. On
2014-06-05 11:32 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-05 11:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-06-05 11:25 - 2014-04-10 14:06 - 00000000 ____D () C:\Users\torsten.schaff\ZPLViewer
2014-06-04 17:31 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-06-04 10:23 - 2014-06-04 10:23 - 00019830 _____ () C:\Users\torsten.schaff\Documents\Fakturavorschau 05_2014 she.xlsx
2014-06-03 12:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-03 07:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-06-02 18:17 - 2013-02-05 19:07 - 00000039 _____ () C:\Windows\vbaddin.ini
2014-05-24 04:48 - 2014-06-12 16:41 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-24 04:47 - 2014-06-12 16:41 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-24 04:47 - 2014-06-12 16:41 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 19290112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 15368704 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 02650112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-24 04:46 - 2014-06-12 16:41 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-24 04:45 - 2014-06-12 16:41 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-24 04:45 - 2014-06-12 16:41 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-24 04:45 - 2014-06-12 16:41 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 14365696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-24 03:26 - 2014-06-12 16:41 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 13731328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 02862080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-24 03:25 - 2014-06-12 16:41 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-24 03:25 - 2014-06-12 16:41 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-24 03:09 - 2014-06-12 16:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-24 03:03 - 2014-06-12 16:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-24 02:13 - 2014-06-12 16:41 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-05-24 02:06 - 2014-06-12 16:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

Some content of TEMP:
====================
C:\Users\admin.sac\AppData\Local\Temp\ose00000.exe
C:\Users\torsten.schaff\AppData\Local\Temp\0ojgkdyz.dll
C:\Users\torsten.schaff\AppData\Local\Temp\0r152loz.dll
C:\Users\torsten.schaff\AppData\Local\Temp\154hktc4.dll
C:\Users\torsten.schaff\AppData\Local\Temp\1co4abl5.dll
C:\Users\torsten.schaff\AppData\Local\Temp\1vm4h0oj.dll
C:\Users\torsten.schaff\AppData\Local\Temp\2dzkkpt0.dll
C:\Users\torsten.schaff\AppData\Local\Temp\2vyq3lae.dll
C:\Users\torsten.schaff\AppData\Local\Temp\45ibib55.dll
C:\Users\torsten.schaff\AppData\Local\Temp\4mn0vagf.dll
C:\Users\torsten.schaff\AppData\Local\Temp\4weuwvqy.dll
C:\Users\torsten.schaff\AppData\Local\Temp\50zx1i41.dll
C:\Users\torsten.schaff\AppData\Local\Temp\5vn3qboa.dll
C:\Users\torsten.schaff\AppData\Local\Temp\a02qsbej.dll
C:\Users\torsten.schaff\AppData\Local\Temp\b3rvrboa.dll
C:\Users\torsten.schaff\AppData\Local\Temp\d30af1ix.dll
C:\Users\torsten.schaff\AppData\Local\Temp\dafxn0hd.dll
C:\Users\torsten.schaff\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\torsten.schaff\AppData\Local\Temp\DeltaTB.exe
C:\Users\torsten.schaff\AppData\Local\Temp\dgi2k1zr.dll
C:\Users\torsten.schaff\AppData\Local\Temp\dmjpxvgi.dll
C:\Users\torsten.schaff\AppData\Local\Temp\flpfmc5t.dll
C:\Users\torsten.schaff\AppData\Local\Temp\flvplayer4free_setup_silent.exe
C:\Users\torsten.schaff\AppData\Local\Temp\hpfhr4nw.dll
C:\Users\torsten.schaff\AppData\Local\Temp\i0ep33ra.dll
C:\Users\torsten.schaff\AppData\Local\Temp\ioudzqtl.dll
C:\Users\torsten.schaff\AppData\Local\Temp\itqsitbc.dll
C:\Users\torsten.schaff\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\torsten.schaff\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\torsten.schaff\AppData\Local\Temp\k44duysu.dll
C:\Users\torsten.schaff\AppData\Local\Temp\lgldzwyi.dll
C:\Users\torsten.schaff\AppData\Local\Temp\LiveSupport_setup.exe
C:\Users\torsten.schaff\AppData\Local\Temp\lum35u0e.dll
C:\Users\torsten.schaff\AppData\Local\Temp\lvvd35pq.dll
C:\Users\torsten.schaff\AppData\Local\Temp\mmxswx4f.dll
C:\Users\torsten.schaff\AppData\Local\Temp\mwlyhhwr.dll
C:\Users\torsten.schaff\AppData\Local\Temp\MyBabylonTB.exe
C:\Users\torsten.schaff\AppData\Local\Temp\nlc3htqc.dll
C:\Users\torsten.schaff\AppData\Local\Temp\olmqqkt3.dll
C:\Users\torsten.schaff\AppData\Local\Temp\ongadysm.dll
C:\Users\torsten.schaff\AppData\Local\Temp\OptimizerPro.exe
C:\Users\torsten.schaff\AppData\Local\Temp\p5k2ufgw.dll
C:\Users\torsten.schaff\AppData\Local\Temp\proxy_vole4867725742305644113.dll
C:\Users\torsten.schaff\AppData\Local\Temp\puq2tik0.dll
C:\Users\torsten.schaff\AppData\Local\Temp\qllgat0o.dll
C:\Users\torsten.schaff\AppData\Local\Temp\RdpUtils.dll
C:\Users\torsten.schaff\AppData\Local\Temp\ResetDevice.exe
C:\Users\torsten.schaff\AppData\Local\Temp\rpbtcrmt.dll
C:\Users\torsten.schaff\AppData\Local\Temp\SkypeSetup.exe
C:\Users\torsten.schaff\AppData\Local\Temp\sSetup-se.exe
C:\Users\torsten.schaff\AppData\Local\Temp\uhkh2vog.dll
C:\Users\torsten.schaff\AppData\Local\Temp\uvaj5t5a.dll
C:\Users\torsten.schaff\AppData\Local\Temp\vcredist9_x86.exe
C:\Users\torsten.schaff\AppData\Local\Temp\wynojbok.dll
C:\Users\torsten.schaff\AppData\Local\Temp\yiczaeel.dll
C:\Users\torsten.schaff\AppData\Local\Temp\zeumexb0.dll
C:\Users\torsten.schaff\AppData\Local\Temp\zf3xcf0r.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 08:33

==================== End Of Log ============================