Windows 8.1 / Habe Anhang Telekom Rechnung geöffnet

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:09 on 18/07/2014 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01
Ran by *** (administrator) on LAPTOP on 18-07-2014 10:15:48
Running from C:\Users\***\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Program Files\mcafee\AppStats\MfeASUM.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
() C:\Program Files (x86)\Acer Incorporated\HID Monitor\HIDMonitor.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
(Dropbox, Inc.) C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicatorCom.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicator.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\mcsvchost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13449288 2013-03-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications))
HKLM\...\Policies\Explorer: [NoCustomizeThisFolder] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Run: [SkyDrive] => C:\Users\***\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-16] (Microsoft Corporation)
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-06-16] (Glarysoft Ltd)
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Run: [HP Deskjet 4620 series (NET)] => C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0x00000000
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoFileMenu] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoRecentDocsMenu] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-1781957500-2277292203-1898425507-1001\...\Policies\Explorer: [NoAddPrinter] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quicken 2014 Zahlungserinnerung.lnk
ShortcutTarget: Quicken 2014 Zahlungserinnerung.lnk -> C:\Windows\Installer\{E60036CF-1E46-4DFE-832F-5476574B30FF}\BillMinder.8C5DA79E_7079_4AB3_81F7_712153351D0D.exe (Macrovision Corporation)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - 2 HP Deskjet 4620 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - 2 HP Deskjet 4620 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 4620 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 4620 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BootExecute: autocheck autochk *  BootDefrag.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM - DefaultScope {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM - {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 - {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - DefaultScope {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = 
SearchScopes: HKCU - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKCU - {BC0DE88A-8DA9-4AD6-B964-E260476DBEEA} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1263.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2013-05-13]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-05-13]

==================== Services (Whitelisted) =================

S2 0107751405666714mcinstcleanup; C:\WINDOWS\TEMP\010775~1.EXE [836168 2014-03-13] (McAfee, Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [660040 2013-01-18] (Acer Incorporated)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HPSLPSVC; C:\Users\***\AppData\Local\Temp\7zS4CFE\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2013-02-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2013-02-18] (Intel Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [155856 2014-06-26] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\mcafee\actwiz\McAWFwk.exe [334760 2012-12-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 MfeASUM; C:\Program Files\McAfee\AppStats\MfeASUM.exe [335216 2013-09-08] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-03-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-04-03] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [189912 2014-04-03] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [17600 2014-06-16] (Glarysoft Ltd)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70592 2014-04-03] (McAfee, Inc.)
R0 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20672 2014-05-16] (Glarysoft Ltd)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
S3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [177544 2014-04-03] (McAfee, Inc.)
R1 MfeASKM; C:\Program Files\McAfee\AppStats\MfeASKM.sys [31408 2013-09-08] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311856 2014-04-03] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69352 2014-04-03] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [522360 2014-04-03] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [784760 2014-04-03] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [441264 2014-03-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-03-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [346760 2014-04-03] (McAfee, Inc.)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
S3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [455240 2013-03-05] (RTS Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-18 10:16 - 2014-07-18 10:16 - 00023962 _____ () C:\Users\***\Desktop\FRST - Kopie.txt
2014-07-18 10:13 - 2014-07-18 10:15 - 00029915 _____ () C:\Users\***\Desktop\Addition.txt
2014-07-18 10:12 - 2014-07-18 10:16 - 00023962 _____ () C:\Users\***\Desktop\FRST.txt
2014-07-18 10:12 - 2014-07-18 10:15 - 00000000 ____D () C:\FRST
2014-07-18 10:10 - 2014-07-18 10:09 - 00000468 _____ () C:\Users\***\Desktop\defogger_disable - Original.log
2014-07-18 10:09 - 2014-07-18 10:11 - 00000470 _____ () C:\Users\***\Desktop\defogger_disable.log
2014-07-18 10:09 - 2014-07-18 10:09 - 00000000 _____ () C:\Users\***\defogger_reenable
2014-07-18 10:02 - 2014-07-18 10:02 - 00380416 _____ () C:\Users\***\Desktop\Gmer-19357.exe
2014-07-18 10:00 - 2014-07-18 10:00 - 02086912 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2014-07-18 10:00 - 2014-07-18 10:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-07-18 09:57 - 2014-07-18 09:57 - 00050477 _____ () C:\Users\***\Desktop\Defogger.exe
2014-07-13 06:28 - 2014-07-13 06:28 - 00000144 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2014-07-13 06:22 - 2014-07-13 06:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-07-13 06:21 - 2014-07-13 06:22 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-13 06:21 - 2014-07-13 06:22 - 00000000 ____D () C:\Program Files\iTunes
2014-07-13 06:21 - 2014-07-13 06:22 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-07-13 06:21 - 2014-07-13 06:21 - 00000000 ____D () C:\Program Files\iPod
2014-07-13 06:12 - 2014-04-14 06:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-07-13 06:07 - 2014-06-05 17:13 - 00216368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2014-07-13 06:07 - 2014-06-05 16:14 - 00189016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2014-07-13 06:07 - 2014-06-02 05:10 - 00423768 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-07-13 06:07 - 2014-05-31 13:07 - 00467800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-07-13 06:07 - 2014-05-31 13:07 - 00440664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys
2014-07-13 06:07 - 2014-05-31 13:07 - 00419672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2014-07-13 06:07 - 2014-05-31 13:07 - 00089944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2014-07-13 06:07 - 2014-05-31 13:07 - 00027480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys
2014-07-13 06:07 - 2014-05-31 09:30 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys
2014-07-13 06:07 - 2014-05-31 09:27 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFPf.sys
2014-07-13 06:07 - 2014-05-31 09:26 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WUDFRd.sys
2014-07-13 06:07 - 2014-05-31 07:01 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFHost.exe
2014-07-13 06:07 - 2014-05-31 07:01 - 00209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFPlatform.dll
2014-07-13 06:07 - 2014-05-31 07:01 - 00099840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFSvc.dll
2014-07-13 06:07 - 2014-05-27 18:53 - 02518360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-07-13 06:07 - 2014-05-27 12:56 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\DaOtpCredentialProvider.dll
2014-07-13 06:07 - 2014-05-27 12:53 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DaOtpCredentialProvider.dll
2014-07-13 06:07 - 2014-05-17 07:59 - 16871936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-07-13 06:07 - 2014-05-17 07:13 - 12711424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-07-13 06:06 - 2014-06-19 04:39 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-07-13 06:06 - 2014-06-19 03:48 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-07-13 06:06 - 2014-06-19 03:16 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-07-13 06:06 - 2014-06-19 03:09 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-07-13 06:06 - 2014-06-19 02:51 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-07-13 06:06 - 2014-06-19 02:50 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-07-13 06:06 - 2014-06-19 02:48 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-07-13 06:06 - 2014-06-19 02:46 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-07-13 06:06 - 2014-06-19 02:39 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-07-13 06:06 - 2014-06-19 02:33 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-07-13 06:06 - 2014-06-19 02:32 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-07-13 06:06 - 2014-06-19 02:27 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-07-13 06:06 - 2014-06-19 02:12 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-07-13 06:06 - 2014-06-19 01:59 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-07-13 06:06 - 2014-06-19 01:58 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-07-13 06:06 - 2014-06-19 01:58 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-07-13 06:06 - 2014-06-19 01:57 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-07-13 06:06 - 2014-06-19 01:52 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-07-13 06:06 - 2014-06-19 01:51 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-07-13 06:06 - 2014-06-19 01:49 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-07-13 06:06 - 2014-06-19 01:45 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-07-13 06:06 - 2014-06-19 01:35 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-07-13 06:06 - 2014-06-19 01:34 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-07-13 06:06 - 2014-06-19 01:15 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-07-13 06:06 - 2014-06-19 01:13 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-07-13 06:06 - 2014-06-19 01:09 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-07-13 06:06 - 2014-06-19 01:07 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-07-13 06:06 - 2014-06-17 01:26 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe
2014-07-13 06:06 - 2014-06-17 01:24 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2014-07-13 06:06 - 2014-06-06 17:20 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-07-13 06:06 - 2014-05-30 06:03 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2014-07-13 06:05 - 2014-06-06 16:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-07-13 06:05 - 2014-06-06 15:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2014-07-13 06:05 - 2014-05-31 13:07 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-07-13 06:05 - 2014-05-31 13:06 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2014-07-13 06:05 - 2014-05-31 06:40 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-07-13 06:05 - 2014-05-31 06:30 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-07-13 06:05 - 2014-05-31 06:12 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-07-13 06:05 - 2014-05-31 06:06 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-07-13 06:05 - 2014-05-31 06:03 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-07-13 06:05 - 2014-05-31 06:01 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-07-13 06:05 - 2014-05-31 05:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-07-13 06:05 - 2014-05-31 05:54 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-07-13 06:05 - 2014-05-31 05:48 - 03463680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-07-13 06:05 - 2014-05-31 05:37 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2014-07-13 06:05 - 2014-05-31 05:36 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-07-13 06:05 - 2014-05-31 05:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2014-07-13 06:05 - 2014-05-31 05:32 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-07-13 06:05 - 2014-05-29 15:02 - 00565576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2014-07-13 06:05 - 2014-05-29 10:55 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2014-07-13 06:05 - 2014-05-29 09:40 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2014-07-13 06:05 - 2014-05-29 09:37 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2014-07-13 06:05 - 2014-05-29 08:34 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2014-07-13 06:05 - 2014-05-29 08:27 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-07-13 05:58 - 2014-07-13 05:58 - 00000451 _____ () C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2014-07-05 23:53 - 2014-07-06 00:04 - 00000499 _____ () C:\WINDOWS\setupact.log
2014-07-05 23:53 - 2014-07-05 23:53 - 00000178 _____ () C:\WINDOWS\setuperr.log
2014-07-05 23:49 - 2014-05-15 01:47 - 04720640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-07-05 23:49 - 2014-05-13 10:01 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\BulkOperationHost.exe
2014-07-05 23:49 - 2014-05-13 08:07 - 02844160 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-07-05 23:49 - 2014-05-13 07:41 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-07-05 23:49 - 2014-05-13 07:27 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-07-05 23:49 - 2014-05-13 07:26 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-07-05 23:49 - 2014-05-13 06:59 - 01035264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-07-05 23:49 - 2014-05-13 06:41 - 01118720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-07-05 23:49 - 2014-05-13 06:31 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-07-05 23:49 - 2014-05-03 14:29 - 01726224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-07-05 23:49 - 2014-05-03 12:20 - 01473080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-07-05 23:49 - 2014-05-03 08:36 - 00997888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-07-05 23:49 - 2014-05-03 08:19 - 00071168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncobjapi.dll
2014-07-05 23:49 - 2014-05-03 08:08 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedynos.dll
2014-07-05 23:49 - 2014-05-03 08:07 - 00262656 _____ (Microsoft Corporation) C:\WINDOWS\system32\framedyn.dll
2014-07-05 23:49 - 2014-05-03 07:46 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncobjapi.dll
2014-07-05 23:49 - 2014-05-03 07:37 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedynos.dll
2014-07-05 23:49 - 2014-05-03 07:37 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\framedyn.dll
2014-07-05 23:49 - 2014-05-03 06:30 - 02641920 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-07-05 23:49 - 2014-05-03 06:27 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-07-05 23:49 - 2014-05-03 02:26 - 00050745 _____ () C:\WINDOWS\system32\srms.dat
2014-07-05 23:49 - 2014-05-01 08:44 - 01025536 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-07-05 23:49 - 2014-04-30 09:43 - 00071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwififlt.sys
2014-07-05 23:49 - 2014-04-30 09:41 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2014-07-05 23:49 - 2014-04-30 09:41 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\agilevpn.sys
2014-07-05 23:49 - 2014-04-30 09:41 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vwifimp.sys
2014-07-05 23:49 - 2014-04-30 08:45 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Robocopy.exe
2014-07-05 23:49 - 2014-04-30 07:48 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Robocopy.exe
2014-07-05 23:49 - 2014-04-30 07:24 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc6.dll
2014-07-05 23:49 - 2014-04-30 07:23 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2014-07-05 23:49 - 2014-04-30 07:23 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2014-07-05 23:49 - 2014-04-30 07:23 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcsvc.dll
2014-07-05 23:49 - 2014-04-30 07:14 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2014-07-05 23:49 - 2014-04-30 06:59 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2014-07-05 23:49 - 2014-04-30 06:46 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2014-07-05 23:49 - 2014-04-30 06:46 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2014-07-05 23:49 - 2014-04-30 06:46 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc6.dll
2014-07-05 23:49 - 2014-04-30 06:45 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcsvc.dll
2014-07-05 23:49 - 2014-04-30 06:42 - 00403968 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
2014-07-05 23:49 - 2014-04-29 01:40 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2014-07-05 23:49 - 2014-04-27 01:03 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-07-05 23:49 - 2014-04-26 23:14 - 02144984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-07-05 23:49 - 2014-04-26 19:39 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2014-07-05 23:49 - 2014-04-14 12:37 - 02125344 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2014-07-05 23:49 - 2014-04-14 11:08 - 01797896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2014-07-05 23:49 - 2014-04-14 08:18 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8thk.dll
2014-07-05 23:49 - 2014-04-09 09:11 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2014-07-05 23:49 - 2014-04-09 08:20 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2014-07-05 23:48 - 2014-05-31 09:27 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-06-20 16:16 - 2014-07-13 06:26 - 00004330 _____ () C:\WINDOWS\PFRO.log
2014-06-20 15:40 - 2014-06-16 10:27 - 00017600 _____ (Glarysoft Ltd) C:\WINDOWS\system32\Drivers\BootDefragDriver.sys

==================== One Month Modified Files and Folders =======

2014-07-18 10:16 - 2014-07-18 10:16 - 00023962 _____ () C:\Users\***\Desktop\FRST - Kopie.txt
2014-07-18 10:16 - 2014-07-18 10:12 - 00023962 _____ () C:\Users\***\Desktop\FRST.txt
2014-07-18 10:15 - 2014-07-18 10:13 - 00029915 _____ () C:\Users\***\Desktop\Addition.txt
2014-07-18 10:15 - 2014-07-18 10:12 - 00000000 ____D () C:\FRST
2014-07-18 10:15 - 2014-05-10 21:50 - 00005118 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for LAPTOP-*** Laptop
2014-07-18 10:11 - 2014-07-18 10:09 - 00000470 _____ () C:\Users\***\Desktop\defogger_disable.log
2014-07-18 10:09 - 2014-07-18 10:10 - 00000468 _____ () C:\Users\***\Desktop\defogger_disable - Original.log
2014-07-18 10:09 - 2014-07-18 10:09 - 00000000 _____ () C:\Users\***\defogger_reenable
2014-07-18 10:09 - 2014-01-08 20:20 - 00000000 ____D () C:\Users\***
2014-07-18 10:05 - 2013-09-06 09:56 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1781957500-2277292203-1898425507-1001
2014-07-18 10:03 - 2014-06-14 11:02 - 01116766 _____ () C:\WINDOWS\WindowsUpdate.log
2014-07-18 10:02 - 2014-07-18 10:02 - 00380416 _____ () C:\Users\***\Desktop\Gmer-19357.exe
2014-07-18 10:02 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-07-18 10:01 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-07-18 10:00 - 2014-07-18 10:00 - 02086912 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2014-07-18 10:00 - 2014-07-18 10:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-07-18 09:58 - 2013-11-05 07:00 - 00000000 ____D () C:\Users\***\AppData\Roaming\ClassicShell
2014-07-18 09:57 - 2014-07-18 09:57 - 00050477 _____ () C:\Users\***\Desktop\Defogger.exe
2014-07-18 09:52 - 2014-05-16 15:20 - 00000000 ___RD () C:\Users\***\Dropbox
2014-07-18 09:52 - 2014-05-16 15:17 - 00000000 ____D () C:\Users\***\AppData\Roaming\DropboxMaster
2014-07-18 09:52 - 2014-05-16 15:16 - 00000000 ____D () C:\Users\***\AppData\Roaming\Dropbox
2014-07-18 09:52 - 2014-05-16 14:58 - 00000344 _____ () C:\WINDOWS\Tasks\GlaryInitialize 5.job
2014-07-18 09:52 - 2014-05-16 14:58 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-07-18 09:52 - 2013-09-06 10:20 - 00000000 ___DO () C:\Users\***\SkyDrive
2014-07-18 09:51 - 2013-08-22 17:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-07-13 08:21 - 2013-08-22 16:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-07-13 08:19 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-07-13 06:28 - 2014-07-13 06:28 - 00000144 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2014-07-13 06:26 - 2014-06-20 16:16 - 00004330 _____ () C:\WINDOWS\PFRO.log
2014-07-13 06:26 - 2013-08-22 17:44 - 00379072 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-07-13 06:22 - 2014-07-13 06:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-07-13 06:22 - 2014-07-13 06:21 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-13 06:22 - 2014-07-13 06:21 - 00000000 ____D () C:\Program Files\iTunes
2014-07-13 06:22 - 2014-07-13 06:21 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-07-13 06:21 - 2014-07-13 06:21 - 00000000 ____D () C:\Program Files\iPod
2014-07-13 06:21 - 2013-11-14 10:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-13 06:21 - 2013-08-22 18:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-07-13 06:21 - 2013-08-22 18:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-13 06:21 - 2013-08-22 18:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-13 06:21 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-07-13 06:16 - 2013-09-06 10:14 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-07-13 06:15 - 2013-09-09 00:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-07-13 06:15 - 2012-07-26 10:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-13 06:13 - 2013-09-09 00:38 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-07-13 06:13 - 2013-08-22 16:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-13 06:02 - 2013-11-14 10:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-07-13 06:02 - 2013-11-14 10:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-07-13 06:02 - 2013-11-14 10:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-07-13 05:58 - 2014-07-13 05:58 - 00000451 _____ () C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2014-07-13 05:56 - 2014-05-11 18:54 - 00000000 ____D () C:\Users\***\AppData\Roaming\DiskDefrag
2014-07-06 02:54 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-07-06 02:54 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-07-06 02:54 - 2013-08-22 18:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-07-06 00:04 - 2014-07-05 23:53 - 00000499 _____ () C:\WINDOWS\setupact.log
2014-07-05 23:53 - 2014-07-05 23:53 - 00000178 _____ () C:\WINDOWS\setuperr.log
2014-07-05 23:53 - 2014-06-13 16:49 - 00000000 ____D () C:\Users\***\Documents\MailStore Home
2014-07-05 23:53 - 2014-06-13 16:49 - 00000000 ____D () C:\ProgramData\firebird
2014-06-26 23:55 - 2014-06-13 15:17 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-06-26 23:55 - 2014-06-13 15:17 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-23 22:39 - 2014-04-25 15:44 - 00000000 ____D () C:\Users\***\Documents\Outlook-Dateien
2014-06-20 15:41 - 2014-05-16 14:58 - 00002964 _____ () C:\WINDOWS\System32\Tasks\GU5SkipUAC
2014-06-20 15:41 - 2014-05-16 14:58 - 00001117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-06-20 15:37 - 2014-06-13 12:59 - 00000548 _____ () C:\BackupLoader.ini
2014-06-19 04:39 - 2014-07-13 06:06 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-06-19 03:48 - 2014-07-13 06:06 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-06-19 03:16 - 2014-07-13 06:06 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-06-19 03:09 - 2014-07-13 06:06 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-06-19 02:51 - 2014-07-13 06:06 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-06-19 02:50 - 2014-07-13 06:06 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-06-19 02:48 - 2014-07-13 06:06 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-06-19 02:46 - 2014-07-13 06:06 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-06-19 02:39 - 2014-07-13 06:06 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-06-19 02:33 - 2014-07-13 06:06 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-06-19 02:32 - 2014-07-13 06:06 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-06-19 02:27 - 2014-07-13 06:06 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-06-19 02:12 - 2014-07-13 06:06 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-06-19 01:59 - 2014-07-13 06:06 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-06-19 01:58 - 2014-07-13 06:06 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-06-19 01:58 - 2014-07-13 06:06 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-06-19 01:57 - 2014-07-13 06:06 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-06-19 01:52 - 2014-07-13 06:06 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-06-19 01:51 - 2014-07-13 06:06 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-06-19 01:49 - 2014-07-13 06:06 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-06-19 01:45 - 2014-07-13 06:06 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-06-19 01:35 - 2014-07-13 06:06 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-06-19 01:34 - 2014-07-13 06:06 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-06-19 01:15 - 2014-07-13 06:06 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-06-19 01:13 - 2014-07-13 06:06 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-06-19 01:09 - 2014-07-13 06:06 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-06-19 01:07 - 2014-07-13 06:06 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzbi1kg.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-13 07:10

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2014 01
Ran by *** at 2014-07-18 10:16:15
Running from C:\Users\***\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

 clear.fi SDK - Video 2 (x32 Version: 2.2.2722 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.2.2729 - CyberLink Corp.) Hidden
Acer Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.01.3004 - Acer Incorporated)
Acer Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.02.3006.4 - Acer Incorporated)
Acer Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.02.3006.6 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3012 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Acer Incorporated)
Acer USB Charge Manager (HKLM\...\{07E867C5-0C48-40FF-A013-DDAF4565AD47}) (Version: 2.00.3004 - Acer Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
CyberLink MediaEspresso 6.5 (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.3729_45993 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3729_45993 - CyberLink Corp.) Hidden
DDBAC (HKLM-x32\...\{E3B6D3FB-A593-41BA-9AB1-FFE46F608565}) (Version: 5.3.21 - DataDesign)
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.3 - Dropbox, Inc.)
ETDWare PS/2-X64 11.6.22.201_WHQL (HKLM\...\Elantech) (Version: 11.6.22.201 - ELAN Microelectronic Corp.)
Glary Utilities 5.2 (HKLM-x32\...\Glary Utilities 5) (Version: 5.2.0.5 - Glarysoft Ltd)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
HID Monitor (HKLM-x32\...\{31923C55-8208-4D0A-8AD6-3AE099A1A741}) (Version: 1.1.5 - Acer Incorporated)
HP Deskjet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{5CF8496F-DBB3-4751-959B-1E931411818A}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Deskjet 4620 series Hilfe (HKLM-x32\...\{8F41F634-440C-427E-B8B7-F2BB85867F26}) (Version: 6.0.0 - Hewlett Packard)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{23CCE784-A812-4647-AEFF-1DCCD4E57478}) (Version: 11.50.0000 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3006 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.0.0.1083 - Intel Corporation) Hidden
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Lexware Info Service (HKLM-x32\...\{8AE7E507-BC49-4DF0-A236-26878691AB53}) (Version: 2.90.00.0009 - Haufe-Lexware GmbH & Co.KG)
Lexware online banking (HKLM-x32\...\{A64DF516-9CDC-4299-BD34-2B2C80CD453B}) (Version: 19.00.00.0059 - Haufe-Lexware GmbH & Co.KG)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3010 - Acer Incorporated)
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
MailStore Home 8.2.0.9316 (HKLM-x32\...\MailStore Home_universal1) (Version: 8.2.0.9316 - MailStore Software GmbH)
McAfee Internet Security Suite (HKLM-x32\...\MSC) (Version: 12.8.958 - McAfee, Inc.)
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4631.1002 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4041.0512 - Microsoft Corporation)
Microsoft Outlook 2013 - de-de (HKLM\...\OutlookRetail - de-de) (Version: 15.0.4631.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Nero BackItUp (x32 Version: 12.5.7000 - Nero AG) Hidden
Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{4CA8F973-6377-4ABF-9ED5-CC2323B3C000}) (Version: 12.5.00500 - Nero AG)
Nero BackItUp Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.15600 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.21800 - Nero AG) Hidden
Nero Launcher (x32 Version: 12.2.7000 - Nero AG) Hidden
Nero RescueAgent (x32 Version: 12.0.11000 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
PDF24 Creator 5.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.222 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.43 - Qualcomm Atheros)
Quicken DELUXE 2014 (HKLM-x32\...\{E60036CF-1E46-4DFE-832F-5476574B30FF}) (Version: 21.37.00.0185 - Haufe-Lexware GmbH & Co.KG)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.14.327.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6870 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C9661090-C134-46E8-90B2-76D72355C2A6}) (Version: 6.2.9200.21222 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Studie zur Verbesserung von HP Deskjet 4620 series Produkten (HKLM\...\{17776F38-ED44-456E-93DA-ABF7D1860EA7}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
System Power Shortcuts (HKLM-x32\...\{87673125-0D68-4740-97F5-5B4336DA7DCD}) (Version: 1.3.8209 - CAPPLOUD)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Tweaker (HKLM-x32\...\{092D4427-C1D9-43C0-B1BB-C8BCFE67D5C0}) (Version: 4.1 - SuRe Softwares)

==================== Restore Points  =========================

20-06-2014 13:57:10 Windows Update
05-07-2014 20:50:19 Windows Update
13-07-2014 03:07:36 Windows Update

==================== Hosts content: ==========================

2013-08-22 16:25 - 2013-08-22 16:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {582339AA-55CB-446D-9C0A-E237D27C9460} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2013-02-08] (CyberLink)
Task: {5B61709A-3183-4063-A9BA-D2D8C497CB45} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {5C9509E8-2A94-4209-AC2C-830C22EBD9A1} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6B61A6C1-6BDC-496F-BEEF-144F3CEF1A40} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-06-19] (Microsoft Corporation)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {6E1B0E51-CB3F-4D45-BB26-063C73DEE24D} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2013-01-18] (Acer Incorporated)
Task: {72C105B6-08E9-457E-BA24-3277EEF2AAD0} - System32\Tasks\HPCustParticipation HP Deskjet 4620 series => C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {783DD56D-EA32-4DCF-A851-958320D87066} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {7A52878F-FBBC-46DB-8992-13428340DA41} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-06-16] (Glarysoft Ltd)
Task: {822AD196-448F-466F-9A57-EB15090F5C6D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-05-20] (Microsoft Corporation)
Task: {86A4C4D3-5F99-4E6A-B1E4-340E1D1CC493} - System32\Tasks\HIDMonitor => C:\Program Files\Acer Incorporated\HID Monitor\HIDMonitor.exe
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8A147FC9-B2A6-482F-87EE-887E9FD0DD68} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {94030231-39A9-43E2-A9AC-62C85535E8F1} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2014-06-16] (Glarysoft Ltd)
Task: {973ED68B-E060-4B63-8236-2000AAEE790A} - System32\Tasks\Microsoft Office 15 Sync Maintenance for LAPTOP-*** Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-03] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A05877D2-FF03-4811-8546-ACE94E4E760B} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-03-13] ()
Task: {A589FF87-7778-4D0D-AB14-E1482B2A986D} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {B662C2A7-78F3-405E-ADF2-605936A6E184} - System32\Tasks\Dolby Selector => C:\Dolby PCEE4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {B8047A32-778A-418F-A182-F0D090E9C81C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C491D23F-0D42-4D1F-8C02-32E250D4DF91} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {C9D3020D-68E4-4E8B-A11A-21CF644AEB8B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-05-20] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DEE24964-4209-4218-AE86-154B49045CB5} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1781957500-2277292203-1898425507-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EB00C10B-4571-4E8F-B48E-56CAD769986C} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {FA74C26E-C8B3-4007-8A0B-FF2FB89CB4CB} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-07-13] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe

==================== Loaded Modules (whitelisted) =============

2014-04-03 19:08 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-08-23 15:02 - 2012-08-23 15:02 - 00030640 _____ () C:\Program Files (x86)\Acer Incorporated\HID Monitor\HIDMonitor.exe
2013-06-29 02:58 - 2013-02-20 23:58 - 00111176 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext_x64.dll
2013-02-28 19:05 - 2013-02-28 19:05 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-02-28 19:02 - 2013-02-28 19:02 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-02-28 19:06 - 2013-02-28 19:06 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-01-04 17:19 - 2013-01-04 17:19 - 00035336 _____ () C:\Program Files (x86)\Acer Incorporated\HID Monitor\ElanTPAPI.dll
2014-06-13 13:12 - 2014-06-13 13:12 - 00316584 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-06-16 11:37 - 2014-06-16 11:37 - 00080160 _____ () C:\Program Files (x86)\Glary Utilities 5\zlib1.dll
2014-07-18 09:52 - 2014-07-18 09:52 - 00043008 _____ () c:\users\***\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzbi1kg.dll
2013-10-19 02:55 - 2013-10-19 02:55 - 25100288 _____ () C:\Users\***\AppData\Roaming\Dropbox\bin\libcef.dll
2014-06-13 13:18 - 2014-06-13 13:18 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2013-06-29 02:18 - 2013-02-18 08:38 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\***\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\Services: ETDService => 2

==================== Faulty Device Manager Devices =============

Name: Bluetooth Audio Device
Description: Bluetooth Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications
Service: BTATH_A2DP
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Virtual Bluetooth Support (Include Audio)
Description: Virtual Bluetooth Support (Include Audio)
Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}
Manufacturer: Qualcomm Atheros Communications
Service: AthBTPort
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Bluetooth LWFLT Device
Description: Bluetooth LWFLT Device
Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}
Manufacturer: Qualcomm Atheros Communications
Service: BTATH_LWFLT
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (07/13/2014 07:14:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20498 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 166c

Startzeit: 01cf9e504f3e759c

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: 38bba1fa-0a44-11e4-beac-0c84dc5dcf34

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/13/2014 06:36:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application bug: DNSServiceResolve(a4:d1:d2:ca:2c:98@fe80::a6d1:d2ff:feca:2c98._apple-mobdev2._tcp.local.) active for over two minutes. This places considerable burden on the network.

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 24

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 23

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 22

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 21

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 20

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 19

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 18

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 17


System errors:
=============
Error: (07/18/2014 09:58:32 AM) (Source: DCOM) (EventID: 10010) (User: LAPTOP)
Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (07/13/2014 06:30:14 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (07/13/2014 06:06:59 AM) (Source: DCOM) (EventID: 10010) (User: LAPTOP)
Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (07/13/2014 06:00:25 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (07/06/2014 01:40:54 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (07/06/2014 01:02:37 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (06/23/2014 10:55:51 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (06/23/2014 10:55:51 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (06/23/2014 10:39:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%1062

Error: (06/23/2014 10:30:05 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP)
Description: {209500FC-6B45-4693-8871-6296C4843751}


Microsoft Office Sessions:
=========================
Error: (07/13/2014 07:14:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20498166c01cf9e504f3e759c4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbwe\LiveComm.exe38bba1fa-0a44-11e4-beac-0c84dc5dcf34microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/13/2014 06:36:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application bug: DNSServiceResolve(a4:d1:d2:ca:2c:98@fe80::a6d1:d2ff:feca:2c98._apple-mobdev2._tcp.local.) active for over two minutes. This places considerable burden on the network.

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 24

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 23

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 22

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 21

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 20

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 19

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 18

Error: (07/13/2014 06:33:15 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 17


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 3971.27 MB
Available physical RAM: 2217.23 MB
Total Pagefile: 4675.27 MB
Available Pagefile: 2737.11 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (HD Laptop) (Fixed) (Total:449.11 GB) (Free:374.65 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 38C7732F)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-18 11:59:29
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002f ST500LT012-9WS142 rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\***\AppData\Local\Temp\uxtdapoc.sys


---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\System32\spoolsv.exe[1288] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                                              00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1288] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                                              00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1288] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                                                 00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1288] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                                                 00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe[1576] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                          00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe[1576] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                          00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe[1576] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                             00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe[1576] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                             00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\windows\system32\mfevtps.exe[1864] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506                                                                                                                              00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\windows\system32\mfevtps.exe[1864] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514                                                                                                                              00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\windows\system32\mfevtps.exe[1864] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                                                                                                                                 00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\windows\system32\mfevtps.exe[1864] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                                                                                                                                 00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\svchost.exe[1488] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                                              00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\svchost.exe[1488] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                                              00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\svchost.exe[1488] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                                                 00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\svchost.exe[1488] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                                                 00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[2080] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                     00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[2080] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                     00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[2080] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                        00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe[2080] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                        00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4240] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                                                                                               00007ff9fc811f6a 4 bytes [81, FC, F9, 7F]
.text    C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4240] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                                                                                               00007ff9fc811f82 4 bytes [81, FC, F9, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe[4664] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                     00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe[4664] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                     00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe[4664] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                        00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\ScanToPCActivationApp.exe[4664] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                        00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4804] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506                                                                                                    00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4804] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514                                                                                                    00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4804] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                                                                                                       00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe[4804] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                                                                                                       00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\system32\RunDll32.exe[4992] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                                             00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\system32\RunDll32.exe[4992] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                                             00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\system32\RunDll32.exe[4992] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                                                00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\system32\RunDll32.exe[4992] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                                                00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\RunDll32.exe[4208] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                                             00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\RunDll32.exe[4208] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                                             00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\RunDll32.exe[4208] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                                                00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\WINDOWS\system32\RunDll32.exe[4208] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                                                00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicatorCom.exe[4424] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                  00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicatorCom.exe[4424] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                  00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicatorCom.exe[4424] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                     00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicatorCom.exe[4424] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                     00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[2384] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506                                                                                                00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[2384] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514                                                                                                00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[2384] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                                                                                                   00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[2384] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                                                                                                   00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[1820] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                                    00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[1820] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                                    00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[1820] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                                       00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[1820] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                                       00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicator.exe[1096] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                                                     00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicator.exe[1096] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                                                     00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicator.exe[1096] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                                                        00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Program Files\HP\HP Deskjet 4620 series\Bin\HPNetworkCommunicator.exe[1096] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                                                        00007ffa16e81832 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe[5156] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506                                                                                                     00007ffa16e8169a 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe[5156] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514                                                                                                     00007ffa16e816a2 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe[5156] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                                                                                                        00007ffa16e8181a 4 bytes [E8, 16, FA, 7F]
.text    C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe[5156] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                                                                                                        00007ffa16e81832 4 bytes [E8, 16, FA, 7F]

---- Threads - GMER 2.1 ----

Thread   C:\WINDOWS\system32\csrss.exe [716:1460]                                                                                                                                                                                  fffff9600099cb90
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5884]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5896]                                                                                                                                                0000000067ec6b62
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5916]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:3116]                                                                                                                                                000000006699f6f4
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:352]                                                                                                                                                 000000006699f6f4
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:1448]                                                                                                                                                000000006699f6f4
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5952]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:2188]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:984]                                                                                                                                                 0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:2392]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:6068]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:6092]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:6072]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5972]                                                                                                                                                0000000067ec6d07
Thread   C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [5456:5976]                                                                                                                                                0000000067ec6d07
---- Processes - GMER 2.1 ----

Process  C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [4908] (FILE NOT FOUND)                                                                  0000000000400000
Library  C:\Users\***\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [4908](2014-01-03 03:42:50)                                                         0000000003dc0000
Library  c:\users\***\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqngpzm.dll (*** suspicious ***) @ C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [4908](2014-07-18 08:29:59)           00000000052a0000
Library  C:\Users\***\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [4908](2013-10-18 23:55:02)                                                               000000006a150000
Library  C:\Users\***\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [4908] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00)                                 00000000697c0000
Library  c:\users\***\appdata\local\temp\7zs4cfe\hpslpsvc64.dll (*** suspicious ***) @ C:\WINDOWS\system32\svchost.exe [5396] (HP Network Devices Support/Hewlett-Packard Co.)(2014-01-17 08:00:08)                                0000000180000000
Library  C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [3704]       0000000067eb0000
Library  C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\csi.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [3704]       0000000066c50000
Library  C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\ACEOLEDB.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [3704]  0000000066c00000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----