Windows 8: Mehrere Trojaner - ständig Popups im IE

fakerr · 23.06.2014, 18:14

Hallo Freunde,

ich habe leider ein Problem bei einem unserer Rechner. Es tauchen immer wieder Popups im Internet Explorer auf. Zusätzlich sind nach jedem Neustart irgendwelche Programme installiert (Bsp.: Allin1Convert). Ich habe aus Verzweiflung schon Spybot S&D, HitmanPro, Adwcleaner durchlaufen lassen. Diese finden immer wieder was. löschen die Sachen, aber nach einem Neustart ist wieder alles da. Norton 360 ist installiert, bringt aber anscheinend nichts.

Deswegen wende ich mich jetzt an euch.

ADWCleaner:

Code:

ATTFilter

# AdwCleaner v3.213 - Bericht erstellt am 23/06/2014 um 18:14:34
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Günter Krüger - BÜRO1
# Gestartet von : C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4G7UOG5\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Allin1Convert_8h
Ordner Gelöscht : C:\Users\GNTERK~1\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Günter Krüger\AppData\LocalLow\Allin1Convert_8hEI

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{889F49D2-6CEA-40BE-BE5F-7217485F9745}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2561FD25-FE31-4E56-A120-AF7FEAAE3124}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16921


*************************

AdwCleaner[R0].txt - [23888 octets] - [16/06/2014 14:13:16]
AdwCleaner[R1].txt - [1068 octets] - [16/06/2014 14:56:14]
AdwCleaner[R2].txt - [1245 octets] - [16/06/2014 18:15:19]
AdwCleaner[R3].txt - [1026 octets] - [22/06/2014 13:08:00]
AdwCleaner[R4].txt - [1777 octets] - [23/06/2014 18:14:09]
AdwCleaner[S0].txt - [21717 octets] - [16/06/2014 14:13:53]
AdwCleaner[S1].txt - [1084 octets] - [16/06/2014 14:56:44]
AdwCleaner[S2].txt - [1261 octets] - [16/06/2014 18:15:37]
AdwCleaner[S3].txt - [1652 octets] - [23/06/2014 18:14:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1712 octets] ##########

Defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:39 on 23/06/2014 (Günter Krüger)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Code:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Günter Krüger (administrator) on BÜRO1 on 23-06-2014 18:42:09
Running from C:\Users\Günter Krüger\Downloads
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPNetworkCommunicatorCom.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
() C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3PQGC9T\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-02-21] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2014-02-21] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [DT HPO] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [HP Officejet Pro X476dw MFP (NET)] => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [EasySpeedCheck] => C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe [194200 2014-05-12] (Probit Software LTD)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> C:\Program Files (x86)\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://1und1.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-02-13]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-06-23]
FF HKCU\...\Firefox\Extensions: [{C9BD4C68-D86F-71D3-5841-B16F1DEC93F6}] - C:\Program Files (x86)\BlockAndSurf-soft\173.xpi

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2014-02-21] (Andrea Electronics Corporation) [File not signed]
R2 AVerRemote; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [364544 2014-02-21] (AVerMedia) [File not signed]
R2 AVerScheduleService; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [772096 2014-02-21] () [File not signed]
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2228440 2014-02-21] (Broadcom Corporation.)
R2 cjpcsc; C:\windows\SysWOW64\cjpcsc.exe [518192 2014-01-27] (REINER SCT)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-07-16] (CyberLink)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [85504 2012-08-15] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129336 2014-02-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-02-21] (Intel Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2014-02-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 AVerIT13x; C:\Windows\System32\Drivers\AVerIT13x_x64.sys [197504 2014-02-21] (AVerMedia TECHNOLOGIES, Inc.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170200 2014-02-21] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [9525936 2013-06-10] (Broadcom Corporation)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 BTWPANFL; C:\windows\system32\drivers\btwpanfl.sys [44912 2014-02-21] (Broadcom Corporation.)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
R3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-06-23] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140620.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\ENG64.SYS [126040 2014-02-12] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\EX64.SYS [2099288 2014-02-12] (Symantec Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-13] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-23 18:42 - 2014-06-23 18:42 - 00021276 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-23 18:40 - 2014-06-23 18:41 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:08 - 2014-06-23 18:12 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:01 - 2014-06-23 06:59 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 18:01 - 2014-06-23 06:59 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:33 - 2014-06-22 17:41 - 00000000 ____D () C:\Qoobox
2014-06-22 17:33 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-22 17:33 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-22 17:33 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-22 17:32 - 2014-06-22 17:39 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:30 - 2014-06-22 17:31 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 13:47 - 2014-06-23 18:01 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 13:46 - 2014-06-22 13:47 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 13:46 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 13:46 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-22 13:46 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:18 - 2014-06-22 13:18 - 00001393 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00001381 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 13:17 - 2014-06-22 13:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:17 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:17 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 14:13 - 2014-06-23 18:14 - 00000000 ____D () C:\AdwCleaner
2014-06-16 14:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-06-16 14:12 - 2011-03-25 20:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-15 13:25 - 2014-06-22 13:35 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-13 12:47 - 2014-06-22 13:37 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:46 - 2014-06-22 13:35 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-13 12:29 - 2014-06-16 13:54 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-13 12:26 - 2014-06-22 14:03 - 00000000 ____D () C:\temp
2014-06-12 13:10 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:10 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-06-12 13:10 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 00:37 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-06-12 13:10 - 2014-05-03 07:47 - 03246592 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-06-12 13:10 - 2014-05-03 05:34 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-06-12 13:10 - 2014-04-30 00:32 - 01301504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-06-12 13:10 - 2014-04-30 00:22 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-06-12 13:10 - 2014-04-03 13:19 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-06-12 13:10 - 2014-04-03 05:44 - 00619008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-06-12 13:10 - 2014-04-01 00:08 - 00387268 _____ () C:\windows\system32\ApnDatabase.xml
2014-06-12 13:10 - 2014-03-25 01:42 - 00305152 _____ (Microsoft Corporation) C:\windows\SysWOW64\wusa.exe
2014-06-12 13:10 - 2014-03-25 00:56 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\wusa.exe
2014-06-12 13:09 - 2014-04-03 13:22 - 02233176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:09 - 2014-03-07 02:47 - 01419264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-06-12 13:09 - 2014-03-07 02:08 - 01845760 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-23 18:42 - 2014-06-23 18:42 - 00021276 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-23 18:41 - 2014-06-23 18:40 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:39 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger
2014-06-23 18:27 - 2014-03-26 16:39 - 00005156 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1
2014-06-23 18:27 - 2014-02-12 08:05 - 02091398 _____ () C:\windows\WindowsUpdate.log
2014-06-23 18:26 - 2014-02-12 09:11 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4255365308-323029514-2548571210-1001
2014-06-23 18:23 - 2012-12-31 02:23 - 00745562 _____ () C:\windows\system32\perfh007.dat
2014-06-23 18:23 - 2012-12-31 02:23 - 00169488 _____ () C:\windows\system32\perfc007.dat
2014-06-23 18:23 - 2012-07-26 09:28 - 01752720 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-23 18:16 - 2014-02-14 18:09 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\CrashDumps
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:15 - 2012-08-01 19:02 - 00189988 _____ () C:\windows\PFRO.log
2014-06-23 18:15 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\addins
2014-06-23 18:15 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-23 18:14 - 2014-06-16 14:13 - 00000000 ____D () C:\AdwCleaner
2014-06-23 18:14 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:12 - 2014-06-23 18:08 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:02 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-06-23 18:01 - 2014-06-22 13:47 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-23 06:59 - 2014-06-23 18:01 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 06:59 - 2014-06-23 18:01 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-22 18:40 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-06-22 18:39 - 2012-07-26 11:45 - 00000000 ____D () C:\windows\SKB
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:41 - 2014-06-22 17:33 - 00000000 ____D () C:\Qoobox
2014-06-22 17:41 - 2014-04-23 06:56 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-22 17:41 - 2012-07-26 07:37 - 00000000 __RHD () C:\Users\Default
2014-06-22 17:39 - 2014-06-22 17:32 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:39 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-06-22 17:31 - 2014-06-22 17:30 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 16:13 - 2014-02-15 13:57 - 04240258 _____ () C:\Users\Günter Krüger\Documents\vrexport.csv
2014-06-22 14:03 - 2014-06-13 12:26 - 00000000 ____D () C:\temp
2014-06-22 13:53 - 2014-06-22 13:17 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:47 - 2014-06-22 13:46 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:37 - 2014-06-13 12:47 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-22 13:35 - 2014-06-15 13:25 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-22 13:35 - 2014-06-13 12:46 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-22 13:20 - 2014-06-22 13:17 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:18 - 2014-06-22 13:18 - 00001393 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00001381 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-20 07:04 - 2014-02-15 16:19 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-18 12:56 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 13:54 - 2014-06-13 12:29 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-15 14:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-13 20:31 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\ELAMBKUP
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-13 06:57 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-06-13 06:56 - 2014-02-15 13:34 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:54 - 2014-02-15 13:34 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-13 06:47 - 2014-02-21 07:51 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-06-13 06:47 - 2014-02-21 07:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-04 11:37 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\Packages
2014-05-31 07:16 - 2014-05-16 06:43 - 00703992 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-31 07:16 - 2014-05-16 06:43 - 00105464 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-24 04:48 - 2014-06-12 13:10 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-24 04:47 - 2014-06-12 13:10 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-24 04:45 - 2014-06-12 13:10 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-05-24 03:25 - 2014-06-12 13:10 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-05-24 03:09 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-24 03:03 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-24 00:37 - 2014-06-12 13:10 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll

Some content of TEMP:
====================
C:\Users\Günter Krüger\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 14:31

==================== End Of Log ============================

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2014
Ran by Günter Krüger at 2014-06-23 18:42:37
Running from C:\Users\Günter Krüger\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
8500A909_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909a (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
AMD Accelerated Video Transcoding (Version: 12.5.100.20821 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{DC7C952E-3B17-9BBE-CED0-152DB6B0BAA2}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AVerMedia TV Player (HKLM-x32\...\InstallShield_{DCF2CF72-8523-4487-9D55-31A6D53AEC57}) (Version: 1.8.1.13080201 - AVerMedia Technologies, Inc.)
AVerMedia TV Player (x32 Version: 1.8.1.13080201 - AVerMedia Technologies, Inc.) Hidden
BdB at work 2013 (HKLM-x32\...\BdB_at_Work_2005_is1) (Version: 2013 - LOGO Datensysteme GmbH)
Bing Bar (HKLM-x32\...\{3611CA6C-5FCA-4900-A329-6A118123CCFC}) (Version: 7.1.355.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BPD_DSWizards (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.30.59.49 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.6300 - Broadcom Corporation)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Connected Music powered by Universal Music Group version 1.0 (HKLM-x32\...\{46037DC7-F927-46DF-935F-D6F122BDD34B}_is1) (Version: 1.0 - Snowite)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.8 - REINER SCT)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5510 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1.5510 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.1.1916 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.1.3109 - CyberLink Corp.)
CyberLink PhotoDirector (x32 Version: 2.0.1.3109 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1902 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.1.1902 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.1.1925 - CyberLink Corp.) Hidden
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1.4407 - CyberLink Corp.)
CyberLink PowerDVD (x32 Version: 10.0.1.4407 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5527 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.4.5527 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Energy Star (HKLM\...\{0FA995CC-C849-4755-B14B-5404CC75DC24}) (Version: 1.0.8 - Hewlett-Packard)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.2.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\...\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1206 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP My Display (HKLM-x32\...\{1F4DDC90-5923-4E49-A4C7-F3CCC954DCA0}) (Version: 1.12.004 - Portrait Displays, Inc.)
HP Officejet Pro 8500 A909 Series (HKLM\...\{49C2B7C1-A4E7-4770-8E30-255795AD4712}) (Version: 14.0 - HP)
HP Officejet Pro X476dw MFP - Grundlegende Software für das Gerät (HKLM\...\{B891D4EC-FAE9-4BCC-810F-D6E764B0F3E1}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Officejet Pro X476dw MFP Hilfe (HKLM-x32\...\{2DB9C60D-9DB6-4C3C-A791-B0291EE49C83}) (Version: 29.0.0 - Hewlett Packard)
HP Postscript Converter (Version: 3.1.3591 - Hewlett-Packard) Hidden
HP Quick Start (HKLM-x32\...\{BB27C290-AB30-4D9E-A5D1-88745AAE42E9}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\...\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Support Assistant (HKLM-x32\...\{FF27F674-821E-4BA2-985B-DDF539C2CD03}) (Version: 7.0.33.6 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
HydraVision (x32 Version: 4.2.236.0 - Advanced Micro Devices, Inc.) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6435.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.757.1 - Intel Corporation) Hidden
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MPM (HKLM-x32\...\{8AEA6737-8AF3-47BB-95CE-AAB62BE68985}) (Version: 1.00.0000 - Hewlett-Packard)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.3.0.12 - Symantec Corporation)
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Pivot Pro Plugin (x32 Version: 9.50.110 - Portrait Displays, Inc.) Hidden
ProductContext (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.28137 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
SDK (x32 Version: 2.28.007 - Portrait Displays, Inc.) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Studie zur Verbesserung von HP Officejet Pro X476dw MFP (HKLM\...\{0F44954A-5793-40DF-9357-9EEC3E475EF1}) (Version: 29.1.973.39397 - Hewlett-Packard Co.)
TeamViewer 5 (HKLM-x32\...\TeamViewer 5) (Version: 5.1.17330  - TeamViewer GmbH)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
VR-NetWorld (HKLM-x32\...\{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}) (Version:  - )
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

03-06-2014 05:19:01 Geplanter Prüfpunkt
10-06-2014 05:31:10 Geplanter Prüfpunkt
18-06-2014 05:03:06 Geplanter Prüfpunkt
22-06-2014 11:40:06 Revo Uninstaller's restore point - sweet-page uninstall
22-06-2014 11:42:28 Revo Uninstaller's restore point - Easy Speed Check
23-06-2014 16:11:51 Prüfpunkt von HitmanPro

==================== Hosts content: ==========================

2012-07-26 07:26 - 2014-06-22 17:39 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {34A6D71C-B0A5-4E95-8FBB-C024A02671E7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)
Task: {3688527B-79D0-43A5-8367-5F8BC0FBEF7F} - \EPUpdater No Task File <==== ATTENTION
Task: {41CAEC9F-9C87-4097-BF32-4A1FBD89267C} - \PC Speed Maximizer Schedule No Task File <==== ATTENTION
Task: {58775D6C-4C0E-4949-A466-CD58D12479E7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: {69244028-F07E-409E-9284-424394972A28} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {765A4E3A-ABFC-4F5F-AA75-E2D7D37011A2} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-20] (Microsoft Corporation)
Task: {7A1FF1A2-F21B-4717-9B88-FED27B956196} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {840F7251-1F04-4FE4-AA06-0FB0D2C44F8E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)
Task: {85147162-114E-49A8-BB7D-D99BDB122A17} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe
Task: {8564A42E-F2DA-4C52-AF2F-CFC7EC10D764} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-06-13] (Microsoft Corporation)
Task: {8BED10A7-A9E4-4E8C-B08F-AA939448AAA0} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {9218D5FA-6CB2-47AB-8CE4-4E2E2288B6FB} - \BlockAndSurf Update No Task File <==== ATTENTION
Task: {97D95D07-9922-45E3-B7D2-6C9B5860D32E} - System32\Tasks\HPCustParticipation HP Officejet Pro X476dw MFP => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPCustPartic.exe [2012-10-30] (Hewlett-Packard Co.)
Task: {9F6AC726-4C40-4B30-8217-07D2D6072C28} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: {A2225059-743B-4C03-B8A9-54D4FA1D8EF1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2012-07-13] (Hewlett-Packard)
Task: {A4EE4CA6-1A0E-42FE-A7AD-08070A416C95} - \BlockAndSurf_wd No Task File <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A7460DC5-CDD5-4003-9979-D73BC1A9E960} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {AF70A4C2-36DA-40FD-AC9C-623538989CE9} - System32\Tasks\System Speedup => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
Task: {B2CCB8F0-D10C-4870-B1F5-886BB07EC772} - \System Speedup_DEFAULT No Task File <==== ATTENTION
Task: {B808A6F4-0E9C-4480-8AFC-9BE5D01A9B6A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {B99A160A-CF4A-4E43-A4DE-3BC83D0424BE} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {C34C5E8E-0646-4B9D-8A0B-D853AF9860F0} - \System Speedup_UPDATES No Task File <==== ATTENTION
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C71E4F00-4EE0-4111-A226-F086728F3B99} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe
Task: {C8B478C6-66A5-4D94-B9C6-89E507E36719} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {D583A18D-2141-4095-ACEB-337B76F0B47A} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {E108E082-B1D7-47BF-A9CE-C2D16FD56A67} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {E66DBD2B-AB74-4DD7-AA7D-524479520010} - \LaunchApp No Task File <==== ATTENTION
Task: {E8D25E8F-F0F2-4E79-B3BB-4331EA4FF7EB} - \Advanced System Protector No Task File <==== ATTENTION
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FC3E7E89-EBD5-4FA1-8A27-5DE43726143E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)

==================== Loaded Modules (whitelisted) =============

2014-02-21 09:15 - 2014-02-21 09:13 - 00772096 _____ () c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
2013-03-22 13:27 - 2013-03-22 13:27 - 00049368 _____ () c:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2014-03-19 08:32 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-02-21 09:15 - 2014-02-21 09:13 - 00163840 _____ () C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
2012-12-30 17:42 - 2010-05-13 18:34 - 00674928 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
2012-08-21 23:57 - 2012-08-21 23:57 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-05-04 18:42 - 2012-05-04 18:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2012-05-04 18:42 - 2012-05-04 18:42 - 00028672 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00120224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesModule.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00048544 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesProxy.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00180224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\zxing.dll
2014-02-12 09:07 - 2014-02-12 09:07 - 00120224 _____ () C:\Users\Günter Krüger\AppData\Local\assembly\dl3\NVKYM7VA.POW\O1GTHLKR.RTH\78274c9c\0017145d_cd85cd01\HPItunesModule.DLL
2014-06-23 18:39 - 2014-06-23 18:39 - 00050477 _____ () C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3PQGC9T\Defogger.exe
2014-02-21 09:15 - 2014-02-21 09:13 - 00053248 _____ () c:\Program Files (x86)\Common Files\AVerMedia\dll\MsgLog.DLL
2014-06-22 13:17 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-22 13:17 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-22 13:17 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-22 13:17 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-22 13:17 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-12-30 17:45 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-02-21 09:01 - 2014-02-21 09:01 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: HP Officejet Pro X476dw MFP
Description: HP Officejet Pro X476dw MFP
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/23/2014 06:16:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OSDManager.exe, Version: 1.0.0.1, Zeitstempel: 0x502d8818
Name des fehlerhaften Moduls: mshtml.dll, Version: 10.0.9200.16921, Zeitstempel: 0x537fddb8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001150a4
ID des fehlerhaften Prozesses: 0x17cc
Startzeit der fehlerhaften Anwendung: 0xOSDManager.exe0
Pfad der fehlerhaften Anwendung: OSDManager.exe1
Pfad des fehlerhaften Moduls: OSDManager.exe2
Berichtskennung: OSDManager.exe3
Vollständiger Name des fehlerhaften Pakets: OSDManager.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OSDManager.exe5

Error: (06/23/2014 06:16:24 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz   konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.   0x0.

Error: (06/23/2014 06:16:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (06/23/2014 06:16:20 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz   konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.   0x0.

Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Kontext:  Anwendung, SystemIndex Katalog

Error: (06/23/2014 04:44:21 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.

Error: (06/23/2014 04:03:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (06/23/2014 01:34:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16921, Zeitstempel: 0x537fc9dc
Name des fehlerhaften Moduls: atidxx32.dll, Version: 8.17.10.451, Zeitstempel: 0x50344246
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000624f2
ID des fehlerhaften Prozesses: 0x144c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5

Error: (06/23/2014 09:30:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OSDManager.exe, Version: 1.0.0.1, Zeitstempel: 0x502d8818
Name des fehlerhaften Moduls: mshtml.dll, Version: 10.0.9200.16921, Zeitstempel: 0x537fddb8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001150a4
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xOSDManager.exe0
Pfad der fehlerhaften Anwendung: OSDManager.exe1
Pfad des fehlerhaften Moduls: OSDManager.exe2
Berichtskennung: OSDManager.exe3
Vollständiger Name des fehlerhaften Pakets: OSDManager.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OSDManager.exe5


System errors:
=============
Error: (06/23/2014 06:18:31 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/23/2014 06:18:21 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/23/2014 06:15:56 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit dem folgenden dienstspezifischen Fehler beendet: 
%%0

Error: (06/23/2014 06:14:35 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/23/2014 04:46:30 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/23/2014 04:46:24 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/23/2014 04:43:48 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000133 (0x0000000000000001, 0x0000000000001e00, 0x0000000000000000, 0x0000000000000000)C:\windows\MEMORY.DMP062314-30218-01

Error: (06/23/2014 04:43:46 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎23.‎06.‎2014 um 16:11:28 unerwartet heruntergefahren.

Error: (06/22/2014 06:42:42 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.

Error: (06/22/2014 06:42:36 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.


Microsoft Office Sessions:
=========================
Error: (06/23/2014 06:16:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OSDManager.exe1.0.0.1502d8818mshtml.dll10.0.9200.16921537fddb8c0000005001150a417cc01cf8efe86f8cd5fC:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exeC:\Windows\SYSTEM32\mshtml.dllc8a10873-faf1-11e3-be8b-9cb70dd018d4

Error: (06/23/2014 06:16:24 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: WSearchIdxPiDer Vorgang wurde erfolgreich beendet.   0x0

Error: (06/23/2014 06:16:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog

Error: (06/23/2014 06:16:20 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: 

Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: WSearchIdxPiDer Vorgang wurde erfolgreich beendet.   0x0

Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Kontext:  Anwendung, SystemIndex Katalog

Error: (06/23/2014 04:44:21 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: 

Error: (06/23/2014 04:03:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8

Error: (06/23/2014 01:34:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE10.0.9200.16921537fc9dcatidxx32.dll8.17.10.45150344246c0000005000624f2144c01cf8ed6d73bb753C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SYSTEM32\atidxx32.dll4f00f9c9-faca-11e3-be89-9cb70dd018d4

Error: (06/23/2014 09:30:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OSDManager.exe1.0.0.1502d8818mshtml.dll10.0.9200.16921537fddb8c0000005001150a4167401cf8eb4febfe0a5C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exeC:\Windows\SYSTEM32\mshtml.dll3e801f70-faa8-11e3-be89-9cb70dd018d4


CodeIntegrity Errors:
===================================
  Date: 2014-06-22 17:39:00.971
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 6080.82 MB
Available physical RAM: 4268.98 MB
Total Pagefile: 12224.82 MB
Available Pagefile: 10153.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1849.7 GB) (Free:1797.36 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:11.84 GB) (Free:1.41 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (USB DISK) (Removable) (Total:0.94 GB) (Free:0.89 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 246AE139)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 968 MB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=967 MB) - (Type=06)

==================== End Of Log ============================

Da ich mit meinem Latein am Ende bin, hoffe ich dass ihr mir helfen könnt.

Vielen Dank

//edit: Das ist ein Rechner im Büro. Da ein Kleinunternehmen -> keine IT. Ich kenne mich etwas damit aus. Aber wie man sieht hat ja bisher alles nichts geholfen.

schrauber · 23.06.2014, 18:26

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

fakerr · 23.06.2014, 18:56

Hi,

danke für die Fixe Antwort.

MBAM:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 23.06.2014
Suchlauf-Zeit: 19:38:56
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.23.11
Rootkit Datenbank: v2014.06.20.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: GÃ¼nter KrÃ¼ger

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 294590
Verstrichene Zeit: 4 Min, 51 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Gnter Krger on 23.06.2014 at 19:46:45,88
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E58CDA9-3B21-4611-A859-26EE28950E61}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{E8A2C5C5-5C68-491F-AA49-CA86A08329C5}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.06.2014 at 19:52:13,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Günter Krüger (administrator) on BÜRO1 on 23-06-2014 19:53:18
Running from C:\Users\Günter Krüger\Downloads
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPNetworkCommunicatorCom.exe
(Probit Software LTD) C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display\dthtml.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-02-21] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2014-02-21] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [DT HPO] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [HP Officejet Pro X476dw MFP (NET)] => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [EasySpeedCheck] => C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe [194200 2014-05-12] (Probit Software LTD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> C:\Program Files (x86)\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://1und1.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-02-13]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-06-23]
FF HKCU\...\Firefox\Extensions: [{C9BD4C68-D86F-71D3-5841-B16F1DEC93F6}] - C:\Program Files (x86)\BlockAndSurf-soft\173.xpi

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2014-02-21] (Andrea Electronics Corporation) [File not signed]
R2 AVerRemote; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [364544 2014-02-21] (AVerMedia) [File not signed]
R2 AVerScheduleService; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [772096 2014-02-21] () [File not signed]
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2228440 2014-02-21] (Broadcom Corporation.)
R2 cjpcsc; C:\windows\SysWOW64\cjpcsc.exe [518192 2014-01-27] (REINER SCT)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-07-16] (CyberLink)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [85504 2012-08-15] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129336 2014-02-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-02-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2014-02-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 AVerIT13x; C:\Windows\System32\Drivers\AVerIT13x_x64.sys [197504 2014-02-21] (AVerMedia TECHNOLOGIES, Inc.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170200 2014-02-21] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [9525936 2013-06-10] (Broadcom Corporation)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 BTWPANFL; C:\windows\system32\drivers\btwpanfl.sys [44912 2014-02-21] (Broadcom Corporation.)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-06-23] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140620.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\ENG64.SYS [126040 2014-02-12] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\EX64.SYS [2099288 2014-02-12] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-13] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-23 19:52 - 2014-06-23 19:52 - 00000928 _____ () C:\Users\Günter Krüger\Desktop\JRT.txt
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 19:45 - 2014-06-23 19:45 - 01016261 _____ (Thisisu) C:\Users\Günter Krüger\Downloads\JRT.exe
2014-06-23 19:44 - 2014-06-23 19:44 - 00001151 _____ () C:\Users\Günter Krüger\Desktop\mbam.txt
2014-06-23 19:34 - 2014-06-23 19:35 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 19:34 - 2014-06-23 19:34 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-23 19:34 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-23 19:34 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-23 19:33 - 2014-06-23 19:33 - 00000085 _____ () C:\windows\wininit.ini
2014-06-23 19:32 - 2014-06-23 19:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Günter Krüger\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-23 19:02 - 2014-06-23 19:02 - 00020287 _____ () C:\Users\Günter Krüger\Downloads\Gmer.txt
2014-06-23 18:57 - 2014-06-23 18:58 - 00168446 _____ () C:\Users\Günter Krüger\Desktop\asd.txt
2014-06-23 18:55 - 2014-06-23 18:55 - 00380416 _____ () C:\Users\Günter Krüger\Downloads\Gmer-19357.exe
2014-06-23 18:42 - 2014-06-23 19:53 - 00021321 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-23 19:53 - 00000000 ____D () C:\FRST
2014-06-23 18:42 - 2014-06-23 18:42 - 00037964 _____ () C:\Users\Günter Krüger\Downloads\Addition.txt
2014-06-23 18:40 - 2014-06-23 18:41 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:08 - 2014-06-23 18:12 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:01 - 2014-06-23 06:59 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 18:01 - 2014-06-23 06:59 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:33 - 2014-06-22 17:41 - 00000000 ____D () C:\Qoobox
2014-06-22 17:33 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-22 17:33 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-22 17:33 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-22 17:32 - 2014-06-22 17:39 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:30 - 2014-06-22 17:31 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:17 - 2014-06-23 19:33 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:17 - 2014-06-23 19:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 14:13 - 2014-06-23 18:14 - 00000000 ____D () C:\AdwCleaner
2014-06-16 14:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-06-16 14:12 - 2011-03-25 20:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-15 13:25 - 2014-06-22 13:35 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-13 12:47 - 2014-06-22 13:37 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:46 - 2014-06-22 13:35 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-13 12:29 - 2014-06-16 13:54 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-13 12:26 - 2014-06-22 14:03 - 00000000 ____D () C:\temp
2014-06-12 13:10 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:10 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-06-12 13:10 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 00:37 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-06-12 13:10 - 2014-05-03 07:47 - 03246592 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-06-12 13:10 - 2014-05-03 05:34 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-06-12 13:10 - 2014-04-30 00:32 - 01301504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-06-12 13:10 - 2014-04-30 00:22 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-06-12 13:10 - 2014-04-03 13:19 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-06-12 13:10 - 2014-04-03 05:44 - 00619008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-06-12 13:10 - 2014-04-01 00:08 - 00387268 _____ () C:\windows\system32\ApnDatabase.xml
2014-06-12 13:10 - 2014-03-25 01:42 - 00305152 _____ (Microsoft Corporation) C:\windows\SysWOW64\wusa.exe
2014-06-12 13:10 - 2014-03-25 00:56 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\wusa.exe
2014-06-12 13:09 - 2014-04-03 13:22 - 02233176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:09 - 2014-03-07 02:47 - 01419264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-06-12 13:09 - 2014-03-07 02:08 - 01845760 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-23 19:53 - 2014-06-23 18:42 - 00021321 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 19:53 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-23 19:52 - 2014-06-23 19:52 - 00000928 _____ () C:\Users\Günter Krüger\Desktop\JRT.txt
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 19:45 - 2014-06-23 19:45 - 01016261 _____ (Thisisu) C:\Users\Günter Krüger\Downloads\JRT.exe
2014-06-23 19:44 - 2014-06-23 19:44 - 00001151 _____ () C:\Users\Günter Krüger\Desktop\mbam.txt
2014-06-23 19:44 - 2014-02-12 09:11 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4255365308-323029514-2548571210-1001
2014-06-23 19:41 - 2014-03-26 16:39 - 00005156 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1
2014-06-23 19:41 - 2014-02-12 08:05 - 01055421 _____ () C:\windows\WindowsUpdate.log
2014-06-23 19:35 - 2014-06-23 19:34 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 19:34 - 2014-06-23 19:34 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2012-12-31 02:23 - 00745562 _____ () C:\windows\system32\perfh007.dat
2014-06-23 19:34 - 2012-12-31 02:23 - 00169488 _____ () C:\windows\system32\perfc007.dat
2014-06-23 19:34 - 2012-07-26 09:28 - 01752720 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-23 19:33 - 2014-06-23 19:33 - 00000085 _____ () C:\windows\wininit.ini
2014-06-23 19:33 - 2014-06-22 13:17 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-23 19:33 - 2014-06-22 13:17 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-23 19:32 - 2014-06-23 19:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Günter Krüger\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-23 19:29 - 2012-08-01 19:02 - 00190342 _____ () C:\windows\PFRO.log
2014-06-23 19:29 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-23 19:02 - 2014-06-23 19:02 - 00020287 _____ () C:\Users\Günter Krüger\Downloads\Gmer.txt
2014-06-23 19:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-06-23 18:58 - 2014-06-23 18:57 - 00168446 _____ () C:\Users\Günter Krüger\Desktop\asd.txt
2014-06-23 18:55 - 2014-06-23 18:55 - 00380416 _____ () C:\Users\Günter Krüger\Downloads\Gmer-19357.exe
2014-06-23 18:42 - 2014-06-23 18:42 - 00037964 _____ () C:\Users\Günter Krüger\Downloads\Addition.txt
2014-06-23 18:41 - 2014-06-23 18:40 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:39 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger
2014-06-23 18:16 - 2014-02-14 18:09 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\CrashDumps
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:15 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\addins
2014-06-23 18:14 - 2014-06-16 14:13 - 00000000 ____D () C:\AdwCleaner
2014-06-23 18:14 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:12 - 2014-06-23 18:08 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-23 06:59 - 2014-06-23 18:01 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 06:59 - 2014-06-23 18:01 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-22 18:40 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-06-22 18:39 - 2012-07-26 11:45 - 00000000 ____D () C:\windows\SKB
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:41 - 2014-06-22 17:33 - 00000000 ____D () C:\Qoobox
2014-06-22 17:41 - 2014-04-23 06:56 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-22 17:41 - 2012-07-26 07:37 - 00000000 __RHD () C:\Users\Default
2014-06-22 17:39 - 2014-06-22 17:32 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:39 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-06-22 17:31 - 2014-06-22 17:30 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 16:13 - 2014-02-15 13:57 - 04240258 _____ () C:\Users\Günter Krüger\Documents\vrexport.csv
2014-06-22 14:03 - 2014-06-13 12:26 - 00000000 ____D () C:\temp
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:37 - 2014-06-13 12:47 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-22 13:35 - 2014-06-15 13:25 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-22 13:35 - 2014-06-13 12:46 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-20 07:04 - 2014-02-15 16:19 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-18 12:56 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 13:54 - 2014-06-13 12:29 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-15 14:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-13 20:31 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\ELAMBKUP
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-13 06:57 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-06-13 06:56 - 2014-02-15 13:34 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:54 - 2014-02-15 13:34 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-13 06:47 - 2014-02-21 07:51 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-06-13 06:47 - 2014-02-21 07:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-04 11:37 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\Packages
2014-05-31 07:16 - 2014-05-16 06:43 - 00703992 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-31 07:16 - 2014-05-16 06:43 - 00105464 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-24 04:48 - 2014-06-12 13:10 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-24 04:47 - 2014-06-12 13:10 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-24 04:45 - 2014-06-12 13:10 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-05-24 03:25 - 2014-06-12 13:10 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-05-24 03:09 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-24 03:03 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-24 00:37 - 2014-06-12 13:10 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll

Some content of TEMP:
====================
C:\Users\Günter Krüger\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 14:31

==================== End Of Log ============================

--- --- ---

--- --- ---

Was mir aufgefallen ist, das Easy Speed Check gehört hier garnicht drauf. Ich lösche das, aber es kommt immer wieder.

fakerr · 23.06.2014, 19:02

Gerade taucht auf einmal ein Popup-Fenster auf.

schrauber · 24.06.2014, 12:42

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

fakerr · 24.06.2014, 21:51

Hey,

weiter geht's:

Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-06-2014
Ran by Günter Krüger at 2014-06-24 18:20:57 Run:1
Running from C:\Users\Günter Krüger\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
*****************

C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====

Firefox ist nicht installiert. Weder im Revo Uninstaller noch unter Programme Funktionen zu sehen.

Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=5c5ee145d68fd04d87514c1f0318076f
# engine=18864
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-24 06:55:31
# local_time=2014-06-24 08:55:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Norton 360'
# compatibility_mode=3598 16777213 100 100 741204 154298627 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 3468671 63142242 0 0
# scanned=241713
# found=3
# cleaned=0
# scan_time=2663
sh=08A0C25B0BF40535697C1C584ACCDA490D6BC882 ft=1 fh=dbe7f66a50ce49ed vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\GNTERK~1\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=9171DCD07F74331C12480D5BBBE7314611B96769 ft=1 fh=8c7cbad4a77e222d vn="Variante von Win32/Toolbar.MyWebSearch.V evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Günter Krüger\AppData\LocalLow\Allin1Convert_8hEI\Installr\Cache\02A56573.exe.vir"
sh=352E15324D870431C6A80AEFA1B3826AF5F8AD7B ft=1 fh=d498158229edd61d vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\8hUninstall Allin1Convert.dll"

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.83  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender             
Norton 360 Premier Edition   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Günter Krüger (administrator) on BÜRO1 on 24-06-2014 22:50:12
Running from C:\Users\Günter Krüger\Downloads
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display\dthtml.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPNetworkCommunicatorCom.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Desktop.exe
() C:\Users\Günter Krüger\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-02-21] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2014-02-21] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [DT HPO] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [HP Officejet Pro X476dw MFP (NET)] => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [EasySpeedCheck] => C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> C:\Program Files (x86)\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://1und1.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-02-13]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-06-24]
FF HKCU\...\Firefox\Extensions: [{C9BD4C68-D86F-71D3-5841-B16F1DEC93F6}] - C:\Program Files (x86)\BlockAndSurf-soft\173.xpi

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2014-02-21] (Andrea Electronics Corporation) [File not signed]
R2 AVerRemote; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [364544 2014-02-21] (AVerMedia) [File not signed]
R2 AVerScheduleService; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [772096 2014-02-21] () [File not signed]
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2228440 2014-02-21] (Broadcom Corporation.)
R2 cjpcsc; C:\windows\SysWOW64\cjpcsc.exe [518192 2014-01-27] (REINER SCT)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-07-16] (CyberLink)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [85504 2012-08-15] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129336 2014-02-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-02-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2014-02-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 AVerIT13x; C:\Windows\System32\Drivers\AVerIT13x_x64.sys [197504 2014-02-21] (AVerMedia TECHNOLOGIES, Inc.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170200 2014-02-21] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [9525936 2013-06-10] (Broadcom Corporation)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 BTWPANFL; C:\windows\system32\drivers\btwpanfl.sys [44912 2014-02-21] (Broadcom Corporation.)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-06-23] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140623.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140624.001\ENG64.SYS [126040 2014-02-12] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140624.001\EX64.SYS [2099288 2014-02-12] (Symantec Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-13] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-24 22:40 - 2014-06-24 22:40 - 00854367 _____ () C:\Users\Günter Krüger\Downloads\SecurityCheck.exe
2014-06-24 19:58 - 2014-06-24 19:58 - 02347384 _____ (ESET) C:\Users\Günter Krüger\Downloads\esetsmartinstaller_deu (1).exe
2014-06-24 18:26 - 2014-06-24 18:26 - 02347384 _____ (ESET) C:\Users\Günter Krüger\Downloads\esetsmartinstaller_deu.exe
2014-06-24 18:24 - 2014-06-24 18:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Günter Krüger\Downloads\revosetup95.exe
2014-06-23 19:52 - 2014-06-23 19:52 - 00000928 _____ () C:\Users\Günter Krüger\Desktop\JRT.txt
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 19:45 - 2014-06-23 19:45 - 01016261 _____ (Thisisu) C:\Users\Günter Krüger\Downloads\JRT.exe
2014-06-23 19:44 - 2014-06-23 19:44 - 00001151 _____ () C:\Users\Günter Krüger\Desktop\mbam.txt
2014-06-23 19:34 - 2014-06-24 22:19 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 19:34 - 2014-06-23 19:34 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-23 19:34 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-23 19:34 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-23 19:33 - 2014-06-23 19:33 - 00000085 _____ () C:\windows\wininit.ini
2014-06-23 19:32 - 2014-06-23 19:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Günter Krüger\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-23 19:02 - 2014-06-23 19:02 - 00020287 _____ () C:\Users\Günter Krüger\Downloads\Gmer.txt
2014-06-23 18:57 - 2014-06-23 18:58 - 00168446 _____ () C:\Users\Günter Krüger\Desktop\asd.txt
2014-06-23 18:55 - 2014-06-23 18:55 - 00380416 _____ () C:\Users\Günter Krüger\Downloads\Gmer-19357.exe
2014-06-23 18:42 - 2014-06-24 22:50 - 00021384 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-24 22:50 - 00000000 ____D () C:\FRST
2014-06-23 18:42 - 2014-06-23 18:42 - 00037964 _____ () C:\Users\Günter Krüger\Downloads\Addition.txt
2014-06-23 18:40 - 2014-06-23 18:41 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:08 - 2014-06-23 18:12 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:01 - 2014-06-23 06:59 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 18:01 - 2014-06-23 06:59 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:33 - 2014-06-22 17:41 - 00000000 ____D () C:\Qoobox
2014-06-22 17:33 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-22 17:33 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-22 17:33 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-22 17:32 - 2014-06-22 17:39 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:30 - 2014-06-22 17:31 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:38 - 2014-06-24 18:25 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-24 18:25 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:17 - 2014-06-24 18:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:17 - 2014-06-23 19:33 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 14:13 - 2014-06-23 18:14 - 00000000 ____D () C:\AdwCleaner
2014-06-16 14:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-06-16 14:12 - 2011-03-25 20:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-15 13:25 - 2014-06-22 13:35 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-13 12:47 - 2014-06-24 18:23 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:46 - 2014-06-22 13:35 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-13 12:29 - 2014-06-16 13:54 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-13 12:26 - 2014-06-22 14:03 - 00000000 ____D () C:\temp
2014-06-12 13:10 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:10 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-06-12 13:10 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 00:37 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-06-12 13:10 - 2014-05-03 07:47 - 03246592 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-06-12 13:10 - 2014-05-03 05:34 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-06-12 13:10 - 2014-04-30 00:32 - 01301504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-06-12 13:10 - 2014-04-30 00:22 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-06-12 13:10 - 2014-04-03 13:19 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-06-12 13:10 - 2014-04-03 05:44 - 00619008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-06-12 13:10 - 2014-04-01 00:08 - 00387268 _____ () C:\windows\system32\ApnDatabase.xml
2014-06-12 13:10 - 2014-03-25 01:42 - 00305152 _____ (Microsoft Corporation) C:\windows\SysWOW64\wusa.exe
2014-06-12 13:10 - 2014-03-25 00:56 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\wusa.exe
2014-06-12 13:09 - 2014-04-03 13:22 - 02233176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:09 - 2014-03-07 02:47 - 01419264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-06-12 13:09 - 2014-03-07 02:08 - 01845760 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-06-24 22:50 - 2014-06-23 18:42 - 00021384 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-24 22:50 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-24 22:40 - 2014-06-24 22:40 - 00854367 _____ () C:\Users\Günter Krüger\Downloads\SecurityCheck.exe
2014-06-24 22:19 - 2014-06-23 19:34 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-24 22:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-06-24 19:58 - 2014-06-24 19:58 - 02347384 _____ (ESET) C:\Users\Günter Krüger\Downloads\esetsmartinstaller_deu (1).exe
2014-06-24 19:45 - 2014-02-12 09:11 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4255365308-323029514-2548571210-1001
2014-06-24 18:35 - 2014-03-26 16:39 - 00005156 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1
2014-06-24 18:35 - 2014-02-12 08:05 - 01110449 _____ () C:\windows\WindowsUpdate.log
2014-06-24 18:30 - 2012-12-31 02:23 - 00745562 _____ () C:\windows\system32\perfh007.dat
2014-06-24 18:30 - 2012-12-31 02:23 - 00169488 _____ () C:\windows\system32\perfc007.dat
2014-06-24 18:30 - 2012-07-26 09:28 - 01752720 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-24 18:26 - 2014-06-24 18:26 - 02347384 _____ (ESET) C:\Users\Günter Krüger\Downloads\esetsmartinstaller_deu.exe
2014-06-24 18:25 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-24 18:25 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-24 18:24 - 2014-06-24 18:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Günter Krüger\Downloads\revosetup95.exe
2014-06-24 18:23 - 2014-06-13 12:47 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-24 18:23 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-24 18:22 - 2014-06-22 13:17 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-24 18:22 - 2012-08-01 19:02 - 00193460 _____ () C:\windows\PFRO.log
2014-06-24 18:22 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-06-24 18:20 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-23 19:52 - 2014-06-23 19:52 - 00000928 _____ () C:\Users\Günter Krüger\Desktop\JRT.txt
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\windows\ERUNT
2014-06-23 19:45 - 2014-06-23 19:45 - 01016261 _____ (Thisisu) C:\Users\Günter Krüger\Downloads\JRT.exe
2014-06-23 19:44 - 2014-06-23 19:44 - 00001151 _____ () C:\Users\Günter Krüger\Desktop\mbam.txt
2014-06-23 19:34 - 2014-06-23 19:34 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-23 19:34 - 2014-06-23 19:34 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-23 19:33 - 2014-06-23 19:33 - 00000085 _____ () C:\windows\wininit.ini
2014-06-23 19:33 - 2014-06-22 13:17 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-23 19:32 - 2014-06-23 19:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Günter Krüger\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-23 19:02 - 2014-06-23 19:02 - 00020287 _____ () C:\Users\Günter Krüger\Downloads\Gmer.txt
2014-06-23 18:58 - 2014-06-23 18:57 - 00168446 _____ () C:\Users\Günter Krüger\Desktop\asd.txt
2014-06-23 18:55 - 2014-06-23 18:55 - 00380416 _____ () C:\Users\Günter Krüger\Downloads\Gmer-19357.exe
2014-06-23 18:42 - 2014-06-23 18:42 - 00037964 _____ () C:\Users\Günter Krüger\Downloads\Addition.txt
2014-06-23 18:41 - 2014-06-23 18:40 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:39 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger
2014-06-23 18:16 - 2014-02-14 18:09 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\CrashDumps
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:15 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\addins
2014-06-23 18:14 - 2014-06-16 14:13 - 00000000 ____D () C:\AdwCleaner
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:12 - 2014-06-23 18:08 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-23 06:59 - 2014-06-23 18:01 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 06:59 - 2014-06-23 18:01 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-22 18:40 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-06-22 18:39 - 2012-07-26 11:45 - 00000000 ____D () C:\windows\SKB
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:41 - 2014-06-22 17:33 - 00000000 ____D () C:\Qoobox
2014-06-22 17:41 - 2014-04-23 06:56 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-22 17:41 - 2012-07-26 07:37 - 00000000 __RHD () C:\Users\Default
2014-06-22 17:39 - 2014-06-22 17:32 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:39 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-06-22 17:31 - 2014-06-22 17:30 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 16:13 - 2014-02-15 13:57 - 04240258 _____ () C:\Users\Günter Krüger\Documents\vrexport.csv
2014-06-22 14:03 - 2014-06-13 12:26 - 00000000 ____D () C:\temp
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:35 - 2014-06-15 13:25 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-22 13:35 - 2014-06-13 12:46 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-20 07:04 - 2014-02-15 16:19 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-18 12:56 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 13:54 - 2014-06-13 12:29 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-15 14:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-13 20:31 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\ELAMBKUP
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-13 06:57 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-06-13 06:56 - 2014-02-15 13:34 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:54 - 2014-02-15 13:34 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-13 06:47 - 2014-02-21 07:51 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-06-13 06:47 - 2014-02-21 07:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-04 11:37 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\Packages
2014-05-31 07:16 - 2014-05-16 06:43 - 00703992 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-31 07:16 - 2014-05-16 06:43 - 00105464 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Günter Krüger\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 14:31

==================== End Of Log ============================

--- --- ---

Ob es geklappt hat sehen wir wenn keine Werbung mehr kommt. Melde mich morgen. Wie sehen die Logs denn aus?

Gruß und gut' Nächtsle

schrauber · 25.06.2014, 18:18

gut. Ich warte dann mal auf deine Rückmeldung

25.06.2014, 18:18	#7
schrauber /// the machine /// TB-Ausbilder	Windows 8: Mehrere Trojaner - ständig Popups im IE gut. Ich warte dann mal auf deine Rückmeldung __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 8: Mehrere Trojaner - ständig Popups im IE

Log-Analyse und Auswertung: Windows 8: Mehrere Trojaner - ständig Popups im IE