Hallo liebes Trojaner-Board-Team,

Ich habe mir vor knapp 10 Tagen etwas fieses auf meinen (5 Jahre alten, zwischendurch nie formatierten) Laptop geholt als ich in einem Copyshop etwas ausdrucken musste und dabei wohl meinen USB-Stick infiziert habe.
Ich hatte es kurz danach gemerkt, als Inhalte in Ordnern auf dem USB-Stick sich in neuen Fenstern öffneten und neue Dateien nur noch als Verknüpfungen angezeigt wurden.
Da das Ganze genau in der Prüfungszeit war und ich absolut keine Zeit für irgendwas außer lernen hatte, war ich so dämlich und hab nur den Rogue-Killer drüber laufen lassen, aber zwischendurch wohl die Logfile gelöscht. Ich hatte zudem mein System 2x mit Malwarebytes Anti-Malware gescannt aber es kam beides mal nichts bei raus, weswegen ich die Logs hier auch nicht anhänge.
Mittlerweile sind die Prüfungen rum aber das ganze wird immer böser. Unter meinen Autostart-programmen zeigt sich ein "SergeleLama.vbs" was sich zu kopieren scheint wenn ich es deaktiviere. Zudem laufen zahlreiche aktive Prozesse ohne Benutzernamen und Beschreibung, die sich nicht mehr beenden lassen (u.A. csrss.exe, winlogon.exe, atieclxx.exe, wacomhost.exe, etc) und mein Laptop wird darunter immer langsamer.

Wäre richtig toll wenn sich da noch was machen ließe oder wenn ihr mir zumindest sagen könnt, ob am (wohl ohnehin schon überfälligen) Formatieren kein Weg vorbei führt.

Vielen Dank!

SegundoSol


Hier die Logfiles:

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by JéRaThie (administrator) on SEGUNDOSOL on 24-07-2014 12:03:10
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
( ) C:\Windows\System32\lxczcoms.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
() E:\Extras\DesktopCoral\DesktopCoral.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
(Spotify Ltd) C:\Users\JéRaThie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [238592 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [422400 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4086432 2014-07-06] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BambooCore] => C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
Winlogon\Notify\WB: E:\Extras\WindowBlinds\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -update activex 
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [Desktop Coral] => E:\Extras\DesktopCoral\DesktopCoral.exe [2303488 2008-11-26] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {45fda274-199a-11df-ab98-0026222e4b24} - G:\StartPortableApps.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {55598bdb-ab70-11de-88a4-0026222e4b24} - D:\Eautorun.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {fc268444-23b4-11df-a7e9-001e65103b4e} - VLkmed0349-v-sd90jk129-0G\1490304-609127988309-709234\taskmgr.exe
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteTray.lnk
ShortcutTarget: EvernoteTray.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/stg_drm.ocx
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/armhelper.ocx
DPF: HKLM-x32 {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 139.18.25.3 139.18.1.2

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @google.com/npPicasa2,version=2.0.0 - C:\Program Files (x86)\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\JéRaThie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\libdivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdivx32.dll (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ssldivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-02-06]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-14]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-10-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-04-13]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Shiretoko\firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://my.jolicloud.com/#!/dashboard
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (Snip-Me - Amazon-Preisalarm) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggbcajkaanddkocabpldmeomjdlgjpag [2014-04-11]
CHR Extension: (AdBlock) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-11]
CHR Extension: (avast! Online Security) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-11]
CHR Extension: (vGet Extension (Video Downloader, DLNA)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hniladkejehjfchadikcbjmgjaogciic [2014-04-11]
CHR Extension: (StayFocusd) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji [2014-04-11]
CHR Extension: (Jolidrive) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfakdllpdfjjbfommlcnfkedmbigkfdo [2014-07-23]
CHR Extension: (Pocket (formerly Read It Later)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2014-04-11]
CHR Extension: (Google Wallet) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Quick Scroll) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc [2014-04-11]
CHR Extension: (Evernote Web Clipper) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-04-27]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-07-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems) [File not signed]
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-07-06] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [627992 2013-12-17] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\tinnoadb.sys [31744 2010-03-12] (Google Inc) [File not signed]
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64752 2014-07-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-06] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2014-07-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-09-09] ()
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-01-04] (Samsung Electronics)
S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4AMD64.sys [22176 2012-04-02] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-09-09] ()
R0 LPCFilter; C:\Windows\SysWOW64\DRIVERS\LPCFilter.sys [32040 2008-05-07] (COMPAL ELECTRONIC INC.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-09-27] () [File not signed]
S3 cpuz130; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz132; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 UnlockMonitor; \??\C:\Program Files (x86)\UnLock IT\v3\UnlockMonitor-x64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 11:27 - 2014-07-24 12:00 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Prüfungsarbeit.doc#
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 02:48 - 2014-07-24 02:48 - 00029531 _____ () C:\Users\JéRaThie\Desktop\gmer.txt
2014-07-24 01:32 - 2014-07-24 11:34 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 19:14 - 2014-07-24 11:36 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-23 17:56 - 2014-07-23 19:01 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-23 11:42 - 2014-07-23 12:04 - 117204143 _____ () C:\Users\JéRaThie\Downloads\xvideos.com_d5c634aaccd72fa1f90a47886ae91c9f.flv
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 22:57 - 2014-07-16 22:58 - 04812672 _____ (Piriform Ltd) C:\Users\JéRaThie\Downloads\ccsetup415.exe
2014-07-16 18:18 - 2014-07-24 11:22 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-16 18:18 - 2014-07-16 18:18 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:05 - 2014-07-16 00:06 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-15 19:51 - 2014-07-15 19:51 - 00848856 _____ (Panda Security ) C:\Users\JéRaThie\Downloads\USBVaccineSetup.exe
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-10 15:46 - 2014-06-07 06:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 15:46 - 2014-06-07 05:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 15:46 - 2014-06-07 04:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 15:46 - 2014-06-07 04:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 15:46 - 2014-06-07 04:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 04:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 15:46 - 2014-06-07 04:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-10 15:46 - 2014-06-07 04:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 04:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 04:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 04:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-10 15:46 - 2014-06-07 04:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 15:46 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 15:46 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 15:46 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 15:46 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 15:46 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 15:46 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-07-10 15:46 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-10 15:46 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-07-10 15:46 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 15:45 - 2014-06-07 02:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 15:45 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 15:45 - 2014-06-06 09:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 15:45 - 2014-05-30 09:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-07 01:53 - 2014-07-12 21:10 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-29 20:22 - 2014-06-29 20:38 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 20:12 - 2014-07-14 19:25 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-28 20:00 - 2014-06-28 20:07 - 00007530 _____ () C:\Users\JéRaThie\Documents\Uninstall Dragon Age Origins.log
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\JéRaThie\Desktop\Skyrim.lnk
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\Gast\Desktop\Skyrim (SKSE).lnk
2014-06-28 19:18 - 2014-06-29 15:22 - 00000000 ____D () C:\Users\JéRaThie\Documents\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000853 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Black_Tree_Gaming
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
2014-06-28 18:12 - 2014-06-29 15:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Skyrim
2014-06-28 18:11 - 2014-06-28 18:12 - 00977294 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_LangPack_MSI369D.txt
2014-06-28 18:10 - 2014-06-28 18:11 - 00000000 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_x64_MSI35B6.txt
2014-06-27 15:30 - 2014-06-28 15:33 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\avidemux
2014-06-25 19:03 - 2014-06-25 19:03 - 00005379 _____ () C:\Windows\SysWOW64\collectionCache.bnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 12:03 - 2014-04-17 08:56 - 00000000 ____D () C:\Users\JéRaThie\Downloads\Malware-removal
2014-07-24 12:03 - 2014-04-16 15:22 - 00000000 ____D () C:\FRST
2014-07-24 12:00 - 2014-07-24 11:27 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Prüfungsarbeit.doc#
2014-07-24 11:57 - 2014-05-19 09:12 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\DropboxMaster
2014-07-24 11:57 - 2011-09-17 15:45 - 00000000 ___RD () C:\Users\JéRaThie\Dropbox
2014-07-24 11:57 - 2011-09-17 15:41 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Dropbox
2014-07-24 11:52 - 2012-11-30 15:33 - 01535175 _____ () C:\Windows\WindowsUpdate.log
2014-07-24 11:39 - 2012-08-13 23:16 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-24 11:36 - 2014-07-23 19:14 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-24 11:34 - 2014-07-24 01:32 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-24 11:28 - 2012-09-12 11:31 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Spotify
2014-07-24 11:26 - 2012-08-21 08:14 - 00003896 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-07-24 11:26 - 2012-08-13 23:16 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-24 11:23 - 2013-01-28 15:13 - 00000000 ____D () C:\Users\Gast
2014-07-24 11:23 - 2011-07-03 04:44 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Rainmeter
2014-07-24 11:23 - 2009-09-09 16:43 - 00000000 ____D () C:\Users\JéRaThie
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\spool
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-07-24 11:23 - 2006-11-02 14:33 - 79429632 _____ () C:\Windows\system32\config\software_previous
2014-07-24 11:23 - 2006-11-02 14:33 - 50069504 _____ () C:\Windows\system32\config\system_previous
2014-07-24 11:22 - 2014-07-16 18:18 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-24 11:22 - 2014-04-10 11:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 11:22 - 2010-08-02 09:50 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-24 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 11:22 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-24 11:22 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-24 11:22 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\registration
2014-07-24 11:16 - 2006-11-02 14:33 - 61865984 _____ () C:\Windows\system32\config\components_previous
2014-07-24 11:16 - 2006-11-02 14:33 - 00057344 _____ () C:\Windows\system32\config\sam_previous
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 03:09 - 2010-10-09 00:47 - 00000000 ____D () C:\ProgramData\Origin
2014-07-24 03:09 - 2006-11-02 17:42 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-24 03:01 - 2013-08-14 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 03:00 - 2013-08-14 20:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 02:59 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\vlc
2014-07-24 02:58 - 2012-05-31 20:32 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-24 02:48 - 2014-07-24 02:48 - 00029531 _____ () C:\Users\JéRaThie\Desktop\gmer.txt
2014-07-24 02:13 - 2012-04-23 17:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 21:14 - 2006-11-02 14:33 - 00360448 _____ () C:\Windows\system32\config\default_previous
2014-07-23 21:14 - 2006-11-02 14:33 - 00024576 _____ () C:\Windows\system32\config\security_previous
2014-07-23 21:09 - 2014-06-03 02:39 - 00024760 _____ () C:\Users\JéRaThie\Desktop\Diagnostik.odt
2014-07-23 21:09 - 2014-04-14 17:46 - 00022464 _____ () C:\Users\JéRaThie\Desktop\BiWi V - Seminar 1.odt
2014-07-23 19:40 - 2012-09-12 11:33 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Spotify
2014-07-23 19:28 - 2014-06-19 17:36 - 00000000 ____D () C:\Users\JéRaThie\Desktop\master thesis
2014-07-23 19:23 - 2014-05-07 14:45 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Farben
2014-07-23 19:01 - 2014-07-23 17:56 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-23 12:04 - 2014-07-23 11:42 - 117204143 _____ () C:\Users\JéRaThie\Downloads\xvideos.com_d5c634aaccd72fa1f90a47886ae91c9f.flv
2014-07-17 03:32 - 2012-07-05 21:22 - 00001150 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA.job
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 23:01 - 2010-09-18 17:29 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-07-16 22:58 - 2014-07-16 22:57 - 04812672 _____ (Piriform Ltd) C:\Users\JéRaThie\Downloads\ccsetup415.exe
2014-07-16 22:54 - 2010-10-22 17:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-07-16 22:54 - 2010-10-22 17:05 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-07-16 22:53 - 2011-01-22 14:38 - 00000000 ____D () C:\Program Files (x86)\Iomega
2014-07-16 22:53 - 2009-06-05 17:07 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\Public\Documents\Audible
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\JéRaThie\Documents\Audible
2014-07-16 22:44 - 2014-06-05 18:42 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-07-16 20:26 - 2014-04-09 00:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-16 19:17 - 2014-04-09 23:26 - 00000000 ____D () C:\AdwCleaner
2014-07-16 18:23 - 2008-01-21 13:10 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-16 18:23 - 2008-01-21 13:09 - 00674274 _____ () C:\Windows\system32\perfh007.dat
2014-07-16 18:23 - 2008-01-21 13:09 - 00146254 _____ () C:\Windows\system32\perfc007.dat
2014-07-16 18:18 - 2014-07-16 18:18 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-16 00:32 - 2012-07-05 21:22 - 00001128 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core.job
2014-07-16 00:09 - 2013-11-30 01:29 - 00000000 ____D () C:\Users\JéRaThie\Downloads\sortieren_alt
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:06 - 2014-07-16 00:05 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-15 19:51 - 2014-07-15 19:51 - 00848856 _____ (Panda Security ) C:\Users\JéRaThie\Downloads\USBVaccineSetup.exe
2014-07-15 19:21 - 2012-02-07 12:15 - 00000248 _____ () C:\lxcz.log
2014-07-14 19:25 - 2014-06-29 20:12 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-12 21:10 - 2014-07-07 01:53 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-11 03:29 - 2006-11-02 17:21 - 05120800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 03:24 - 2006-11-02 17:07 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 03:06 - 2014-04-17 02:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 03:02 - 2006-11-02 14:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 22:51 - 2011-05-22 00:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-06 23:39 - 2010-09-17 00:59 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-07-06 23:38 - 2014-04-25 16:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-07-06 23:38 - 2011-04-13 02:03 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-07-06 23:38 - 2011-01-19 02:24 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-07-06 23:38 - 2010-09-17 00:59 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00065264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00064752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswrdr.sys
2014-07-03 23:04 - 2009-09-14 14:35 - 00213504 _____ () C:\Users\JéRaThie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-03 23:02 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\dvdcss
2014-06-30 09:28 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\Branding
2014-06-29 22:58 - 2014-04-15 00:18 - 00000132 _____ () C:\Users\JéRaThie\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-06-29 20:38 - 2014-06-29 20:22 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 15:22 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\Documents\Nexus Mod Manager
2014-06-29 15:02 - 2014-06-28 18:12 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Skyrim
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-29 04:07 - 2014-04-09 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-29 04:07 - 2014-04-09 00:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-28 20:07 - 2014-06-28 20:00 - 00007530 _____ () C:\Users\JéRaThie\Documents\Uninstall Dragon Age Origins.log
2014-06-28 20:01 - 2010-12-16 01:03 - 00000000 ____D () C:\Users\JéRaThie\Documents\BioWare
2014-06-28 20:01 - 2010-04-12 19:00 - 00000000 ____D () C:\ProgramData\BioWare
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\JéRaThie\Desktop\Skyrim.lnk
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\Gast\Desktop\Skyrim (SKSE).lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000853 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Black_Tree_Gaming
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
2014-06-28 18:12 - 2014-06-28 18:11 - 00977294 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_LangPack_MSI369D.txt
2014-06-28 18:12 - 2011-01-22 13:45 - 00259266 _____ () C:\Users\JéRaThie\AppData\Local\dd_dotnetfx35install_lp.txt
2014-06-28 18:12 - 2010-11-29 16:19 - 01750032 _____ () C:\Users\JéRaThie\AppData\Local\dd_dotnetfx35install.txt
2014-06-28 18:12 - 2010-11-29 16:19 - 01608393 _____ () C:\Users\JéRaThie\AppData\Local\dd_depcheck_NETFX_EXP_35.txt
2014-06-28 18:12 - 2010-08-29 23:01 - 00000000 ____D () C:\Users\JéRaThie\Documents\My Games
2014-06-28 18:11 - 2014-06-28 18:10 - 00000000 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_x64_MSI35B6.txt
2014-06-28 15:33 - 2014-06-27 15:30 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\avidemux
2014-06-25 19:03 - 2014-06-25 19:03 - 00005379 _____ () C:\Windows\SysWOW64\collectionCache.bnk

Some content of TEMP:
====================
C:\Users\JéRaThie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppkcrsp.dll
C:\Users\JéRaThie\AppData\Local\Temp\Quarantine.exe
C:\Users\JéRaThie\AppData\Local\Temp\rtdrvmon.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-24 11:33

==================== End Of Log ============================
         

Addition.Txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014
Ran by JéRaThie at 2014-07-24 12:04:03
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AC3Filter 2.5b (HKLM-x32\...\AC3Filter_is1) (Version: 2.5b - Alexander Vigovsky)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)
Adobe InDesign CS2 (HKLM-x32\...\Adobe InDesign CS2 - {7F4C8163-F259-49A0-A018-2857A90578BC}) (Version: 004.000.000 - Adobe Systems Incorporated)
Adobe InDesign CS2 (x32 Version: 004.000.000 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version:  3.0 - Adobe Systems, Inc.)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.102.302.104 - ALPS ELECTRIC CO., LTD.)
AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{82C9101B-36EC-5821-DD8B-05480074A0B8}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{F5266D28-E0B2-4130-BFC5-EE155AD514DC}) (Version: 2.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arcanum Of Steamworks and Magick Obscura (HKLM-x32\...\Arcanum Of Steamworks and Magick Obscura_is1) (Version:  - GOG.com)
ArtRage 2 (HKLM-x32\...\{B9BD670E-E9BF-494A-9843-F20C13EE8C4C}) (Version: 2.6.0 - Ambient Design)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)
Bamboo Dock (HKLM-x32\...\Bamboo Dock) (Version: 4.1 - Wacom Co., Ltd.)
Bamboo Dock (x32 Version: 4.1.0 - Wacom Europe GmbH) Hidden
Bamboo Tablets Tutorial (x32 Version: 3.0.20 - Wacom) Hidden
Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version:  - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version:  - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.0421.2132.36832 - ATI Technologies, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Pro Control Center (x32 Version: 2012.0405.2205.37728 - Ihr Firmenname) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.09 - Piriform)
Desktop Coral 1.03.01 (HKLM-x32\...\DesktopCoral_is1) (Version:  - )
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
Dreamfall: The Longest Journey (HKLM-x32\...\Steam App 6300) (Version:  - Funcom)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
DScaler (HKLM-x32\...\DScaler_is1) (Version:  - )
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
Dungeon Keeper 2 (HKLM\...\{4f94b43a-8a00-4ac4-bb94-269cf24aef97}.sdb) (Version:  - )
Dungeon Keeper 2 (HKLM-x32\...\Dungeon Keeper 2_is1) (Version:  - GOG.com)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Eufloria (HKLM-x32\...\Steam App 41210) (Version:  - )
Evernote v. 5.4.1 (HKLM-x32\...\{A5F7DF42-F67D-11E3-B7EB-00163E98E7D6}) (Version: 5.4.1.3962 - Evernote Corp.)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Fallout (HKLM-x32\...\GOGPACKFALLOUT_is1) (Version: 2.0.0.14 - GOG.com)
Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version:  - Q, Timeslip)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)
From Dust (HKLM-x32\...\Steam App 33460) (Version:  - )
GOG.com Downloader version 3.4.8 (HKLM-x32\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.4.8 - GOG.com)
GOG.com Planescape Torment (HKLM\...\{8f376ce2-c213-4a6c-a329-0b2a7eb2bad8}.sdb) (Version:  - )
Gone Home (HKLM-x32\...\Steam App 232430) (Version:  - The Fullbright Company)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
hp psc 1200 series (x32 Version: 1.10.0000 - Hewlett-Packard Company) Hidden
iCloud (HKLM\...\{8B485965-8EFE-464A-842F-CF8F18C3DFD7}) (Version: 1.1.0.40 - Apple Inc.)
Image Data Converter (HKLM-x32\...\{87998E4E-6D9C-411B-AAE9-B8523FFE357D}) (Version: 4.0.01.09151 - Sony Corporation)
iTunes (HKLM\...\{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}) (Version: 10.6.3.25 - Apple Inc.)
Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version:  - Big Huge Games)
Lexmark 1200 Series (HKLM\...\Lexmark 1200 Series) (Version:  - Lexmark International, Inc.)
MAGIX Screenshare (HKLM-x32\...\{D96ED789-9A41-4A89-99A4-3CE466A80DF2}) (Version: 4.3.6.1987 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Mount & Blade: Warband (HKLM-x32\...\Steam App 48700) (Version:  - Tale Worlds)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB941833) (HKLM-x32\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Music Rescue (HKLM-x32\...\{3364BD16-5A28-4862-86A1-A8FF5FD23919}) (Version: 4.0.9.25 - KennettNet Software Ltd)
Neverwinter Nights 2 Complete (HKLM-x32\...\GOGPACKNWN2COMPLETE_is1) (Version: 2.1.0.6 - GOG.com)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.50.3 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}) (Version: 9.11.1111 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 8.6.0.357 - Electronic Arts, Inc.)
Osmos (HKLM-x32\...\Steam App 29180) (Version:  - Hemisphere Games)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
Papers, Please (HKLM-x32\...\Steam App 239030) (Version:  - 3909)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Planescape Torment (HKLM-x32\...\GOGPACKPLANESCAPETORMENT_is1) (Version: 2.0.0.8 - GOG.com)
Rainmeter (HKLM-x32\...\Rainmeter) (Version:  - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20132 - Realtek Semiconductor Corp.)
Reus (HKLM-x32\...\Steam App 222730) (Version:  - Abbey Games)
RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version:  - Punk Software)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.6 - Rockstar Games)
SecureW2 EAP Suite 1.1.3 for Windows (HKLM-x32\...\SecureW2 EAP Suite) (Version:  - )
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB)
Star Wars: Knights of the Old Republic II (HKLM-x32\...\Steam App 208580) (Version:  - LucasArts)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Symphony (HKLM-x32\...\Steam App 207750) (Version:  - Empty Clip Studios)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM-x32\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version:  - )
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.6C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisor Password (x32 Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM-x32\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.3C - TOSHIBA CORPORATION)
Trine (HKLM-x32\...\Trine_is1) (Version:  - Frozenbyte, Inc.)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version:  - Haemimont Games)
TSLRCM 1.6 (HKLM-x32\...\The Sith Lords Restored Content Mod_is1) (Version:  - )
Two Worlds II (HKLM-x32\...\Steam App 7520) (Version:  - )
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Utility Common Driver (x32 Version: 1.0.50.22C - TOSHIBA) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.3-2 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
World of Goo (HKLM-x32\...\Steam App 22000) (Version:  - 2D BOY)
YOU DON'T KNOW JACK® 3 - Abwärts! (HKLM-x32\...\YDKJG3) (Version:  - )

==================== Custom CLSID entries: ==========================

(Only entries are listed that could be exploited by malware. If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\JéRaThie\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

17-07-2014 01:56:05 Geplanter Prüfpunkt
23-07-2014 15:43:23 Windows Update
23-07-2014 23:27:11 avast! antivirus system restore point
24-07-2014 00:01:14 Windows Update
24-07-2014 01:00:12 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 14:34 - 2014-07-16 19:08 - 00000709 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {16CE0B6E-4678-498F-814A-6BDEC0C2F0ED} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {189E45FF-9376-4DD4-BE43-2768C6D5A365} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - JéRaThie => C:\Program Files (x86)\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {1E560156-A445-435D-9DD7-195ACD950758} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {1EF79A2B-FC33-4250-9E80-1A2D89F8FE99} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-13] (Google Inc.)
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {266286FD-716E-48A6-B4E6-2716B6592FB9} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {3F861458-5006-48C7-A7C0-EB888F94DBE7} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {4B944DC3-8D08-40FA-A356-955260DCEE78} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {511BE410-85AF-46F9-B9FB-024F686E67E9} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {5B37AE3A-FAC2-4175-A4E1-5B5E52A6859F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {5EBF65B8-8E01-4FC4-8EEC-299958F4BED4} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {9C3F21C7-4CC1-47FF-8F39-41A3576BEDC4} - System32\Tasks\{BB40B51D-98F9-4E31-AF44-DAA137D7016E} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)
Task: {A46A73A4-AA64-4360-9C62-A75176EACF6A} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {AFFFA717-6094-4CD5-88E4-322B57E2109F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {C2C9CDF8-4599-4EED-A27E-FCCD87AFCFA2} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-07-06] (AVAST Software)
Task: {C594F0E7-233E-46CD-A14D-50B7E1EBA207} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-13] (Google Inc.)
Task: {DB0423D4-4B37-4DBE-80FA-2444FAD0407B} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {DCFF9DEB-8231-403A-8510-EBCD5519CD1F} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {EBAFF3DA-DAF2-4EF5-8A9F-F543FFAE4EAA} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {EFC9F7ED-B395-4A72-8E99-1B7F0641A2B8} - System32\Tasks\{BB5FF825-1022-47B3-BF09-0B7A73A81149} => Chrome.exe hxxp://www.skype.com/go/downloading?source=installer&ver=6.0.60.120&LastError=-9
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\avast! Emergency Update.job => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core.job => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA.job => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2006-12-04 02:26 - 2006-12-04 02:26 - 00022016 _____ () C:\Windows\System32\sugs1l6.dll
2012-06-05 03:26 - 2012-04-06 03:09 - 00045056 _____ () C:\Windows\system32\atitmp64.dll
2014-04-12 17:24 - 2013-12-17 03:17 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2010-08-02 09:50 - 2007-09-02 13:58 - 00495616 _____ () C:\Program Files (x86)\RocketDock\RocketDock.exe
2011-07-03 22:33 - 2008-11-26 13:16 - 02303488 _____ () E:\Extras\DesktopCoral\DesktopCoral.exe
2011-07-03 16:03 - 2011-07-03 16:03 - 00102912 _____ () C:\Program Files\Rainmeter\Rainmeter.exe
2011-07-03 16:03 - 2011-07-03 16:03 - 00839680 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2011-07-03 16:03 - 2011-07-03 16:03 - 00025600 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll
2011-07-03 16:04 - 2011-07-03 16:04 - 00167936 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll
2012-10-16 11:39 - 2012-10-16 11:39 - 00646744 _____ () C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
2014-04-07 01:12 - 2014-07-06 23:38 - 00301152 _____ () C:\Program Files\Alwil Software\Avast5\aswProperty.dll
2014-07-24 01:56 - 2014-07-24 01:56 - 02794496 _____ () C:\Program Files\Alwil Software\Avast5\defs\14072300\algo.dll
2014-07-24 11:53 - 2014-07-24 11:53 - 02794496 _____ () C:\Program Files\Alwil Software\Avast5\defs\14072400\algo.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-08-02 09:50 - 2007-09-02 13:57 - 00069632 _____ () C:\Program Files (x86)\RocketDock\RocketDock.dll
2014-07-24 11:26 - 2014-07-24 11:26 - 00043008 _____ () c:\Users\JéRaThie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppkcrsp.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00436576 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00318304 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2013-11-23 23:32 - 2014-07-06 23:38 - 19329904 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 21118304 _____ () C:\Program Files (x86)\Evernote\Evernote\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00985968 _____ () C:\Program Files (x86)\Evernote\Evernote\avcodec-54.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00136048 _____ () C:\Program Files (x86)\Evernote\Evernote\avutil-51.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00192368 _____ () C:\Program Files (x86)\Evernote\Evernote\avformat-54.dll
2013-07-11 13:33 - 2013-07-11 13:33 - 00988160 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxml2.dll
2013-07-10 22:08 - 2013-07-10 22:08 - 00170496 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxslt.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-04-10 11:08 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll
2014-04-10 11:08 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\TEMP:196FC0A6
AlternateDataStreams: C:\ProgramData\TEMP:6F770ABC
AlternateDataStreams: C:\ProgramData\TEMP:7D6EC5BE

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^JéRaThie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupreg: Google Update => "C:\Users\JéRaThie\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: TkBellExe => "c:\program files (x86)\real\realplayer\update\realsched.exe"  -osboot

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/24/2014 11:24:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 02:11:48 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.

Error: (07/24/2014 01:27:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.

Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.

Error: (07/23/2014 05:34:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 11:06:07 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (07/23/2014 10:30:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/18/2014 02:50:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2014 04:58:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (07/24/2014 11:34:51 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:46 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:40 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:35 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:30 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:25 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:20 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:14 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:08 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo

Error: (07/24/2014 11:34:03 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo


Microsoft Office Sessions:
=========================
Error: (07/24/2014 11:24:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 02:11:48 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe

Error: (07/24/2014 01:27:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe

Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe

Error: (07/23/2014 05:34:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 11:06:07 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (07/23/2014 10:30:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/18/2014 02:50:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/17/2014 04:58:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-07-23 19:50:31.646
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:31.435
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:31.223
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:31.013
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:29.595
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:29.383
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:29.171
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:50:28.959
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:43:31.092
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-23 19:43:30.879
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 61%
Total physical RAM: 4059.93 MB
Available physical RAM: 1560.82 MB
Total Pagefile: 8323.08 MB
Available Pagefile: 5130.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Vista) (Fixed) (Total:149.04 GB) (Free:16.9 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:147.58 GB) (Free:1.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 7878FC96)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=148 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Das GMER-Logfile hat nicht mehr reingepasst, daher kommt es hier noch hinterher:

GMER:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-24 02:48:09
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.12.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\JRATHI~1\AppData\Local\Temp\pwldiuog.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\system32\DRIVERS\USBPORT.SYS!DllUnload + 1                                                                                                                                                                      fffffa600332ef61 11 bytes {MOV RAX, 0xfffffa8007a7d2a0; JMP RAX}
.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                                                                            fffff9600017fc00 3 bytes [80, 82, 02]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 4                                                                                                                                                                        fffff9600017fc04 3 bytes [41, B6, FA]
.text    ...                                                                                                                                                                                                                        * 133
.text    C:\Windows\System32\win32k.sys!EngGetProcessHandle + 300                                                                                                                                                                   fffff9600022903c 6 bytes {JMP QWORD [RIP+0x4cf52]}

---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\wininit.exe[696] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\winlogon.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\services.exe[780] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\svchost.exe[952] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Windows\System32\svchost.exe[344] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\atiesrxx.exe[564] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Windows\System32\svchost.exe[620] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Windows\System32\svchost.exe[692] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\svchost.exe[764] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                 0000000076e82f42 1 byte [62]
.text    C:\Program Files\Tablet\Pen\WTabletServiceCon.exe[1272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                              0000000076e82f42 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1864] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Program Files\Tablet\Pen\WacomHost.exe[1948] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                                      00000000767b4760 1 byte [62]
.text    C:\Windows\system32\taskeng.exe[2000] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Windows\Explorer.EXE[1592] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                        0000000076e82f42 1 byte [62]
.text    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1696] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                   00000000767b4760 1 byte [62]
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2084] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194                                                                                        0000000076e82f42 1 byte [62]
.text    C:\Program Files\Windows Defender\MSASCui.exe[2456] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                  0000000076e82f42 1 byte [62]
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2492] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Program Files\Apoint2K\Apoint.exe[2500] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                           0000000076e82f42 1 byte [62]
.text    C:\Program Files (x86)\RocketDock\RocketDock.exe[2660] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                               00000000767b4760 1 byte [62]
.text    E:\Extras\DesktopCoral\DesktopCoral.exe[2668] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                                        00000000767b4760 1 byte [62]
.text    C:\Users\JéRaThie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[2688] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                            00000000767b4760 1 byte [62]
.text    C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe[2744] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                      00000000767b4760 1 byte [62]
.text    C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe[2752] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                   00000000767b4760 1 byte [62]
.text    C:\Program Files\Rainmeter\Rainmeter.exe[2800] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                       0000000076e82f42 1 byte [62]
.text    C:\Program Files\Alwil Software\Avast5\AvastUI.exe[2856] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                      0000000076731ab6 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text    C:\Program Files\Alwil Software\Avast5\AvastUI.exe[2856] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                             00000000767b4760 1 byte [62]
.text    C:\Program Files (x86)\Bamboo Dock\BambooCore.exe[2888] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                              00000000767b4760 1 byte [62]
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2592] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                        0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\SearchIndexer.exe[2308] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                          0000000076e82f42 1 byte [62]
.text    C:\Program Files\Apoint2K\ApMsgFwd.exe[3628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                         0000000076e82f42 1 byte [62]
.text    C:\Program Files\Tablet\Pen\Pen_TouchUser.exe[1172] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                  0000000076e82f42 1 byte [62]
.text    C:\Program Files\Apoint2K\Apntex.exe[3772] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                           0000000076e82f42 1 byte [62]
.text    C:\Windows\system32\wuauclt.exe[3252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194                                                                                                                                0000000076e82f42 1 byte [62]
.text    C:\Users\JéRaThie\Downloads\Malware-removal\Gmer-19357.exe[4692] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130                                                                                                     00000000767b4760 1 byte [62]

---- Devices - GMER 2.1 ----

Device   \FileSystem\Ntfs \Ntfs                                                                                                                                                                                                     fffffa8004ac22c0
Device   \Driver\usbehci \Device\USBFDO-7                                                                                                                                                                                           fffffa8007ba42c0
Device   \Driver\usbuhci \Device\USBPDO-5                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbehci \Device\USBFDO-3                                                                                                                                                                                           fffffa8007ba42c0
Device   \Driver\usbuhci \Device\USBPDO-1                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\iScsiPrt \Device\RaidPort0                                                                                                                                                                                         fffffa8007c862c0
Device   \Driver\cdrom \Device\CdRom0                                                                                                                                                                                               fffffa8007c212c0
Device   \Driver\netbt \Device\NetBT_Tcpip_{4CBE19F4-5EA4-431E-B673-FE3873B9E159}                                                                                                                                                   fffffa80088742c0
Device   \Driver\usbuhci \Device\USBPDO-6                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBFDO-4                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBFDO-0                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBPDO-2                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbehci \Device\USBPDO-7                                                                                                                                                                                           fffffa8007ba42c0
Device   \Driver\usbuhci \Device\USBFDO-5                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbehci \Device\USBPDO-3                                                                                                                                                                                           fffffa8007ba42c0
Device   \Driver\usbuhci \Device\USBFDO-1                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\volmgr \Device\HarddiskVolume1                                                                                                                                                                                     fffffa8004ab82c0
Device   \Driver\volmgr \Device\FtControl                                                                                                                                                                                           fffffa8004ab82c0
Device   \Driver\volmgr \Device\VolMgrControl                                                                                                                                                                                       fffffa8004ab82c0
Device   \Driver\volmgr \Device\HarddiskVolume2                                                                                                                                                                                     fffffa8004ab82c0
Device   \Driver\netbt \Device\NetBT_Tcpip_{2573FD55-FA24-433C-9AED-2BE8FD3687AB}                                                                                                                                                   fffffa80088742c0
Device   \Driver\volmgr \Device\HarddiskVolume3                                                                                                                                                                                     fffffa8004ab82c0
Device   \Driver\netbt \Device\NetBt_Wins_Export                                                                                                                                                                                    fffffa80088742c0
Device   \Driver\usbuhci \Device\USBFDO-6                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBPDO-4                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBFDO-2                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\usbuhci \Device\USBPDO-0                                                                                                                                                                                           fffffa8007b852c0
Device   \Driver\iScsiPrt \Device\ScsiPort1                                                                                                                                                                                         fffffa8007c862c0
Device   \Driver\Smb \Device\NetbiosSmb                                                                                                                                                                                             fffffa80088912c0
---- Processes - GMER 2.1 ----

Library  C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe [2744](2014-01-03 01:09:26)                                                0000000004200000
Library  c:\users\jrathi~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpelpisu.dll (*** suspicious ***) @ C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe [2744](2014-07-23 23:29:41)  0000000003f50000
Library  C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe [2744](2013-08-23 19:01:44)                                                      0000000066a90000
Library  C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe [2744] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42)                        0000000062240000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application@Sources                                                                                                                                                        MSDMine?DfSdk
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                                                                                                                         771343423
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                                                                                                                         285507792
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                                                                                                                         1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                        0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                     0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet002\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet003\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet004\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet005\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet006\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet007\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet008\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet009\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKLM\SYSTEM\ControlSet011\Services\Eventlog\Application@Sources                                                                                                                                                            MSDMine?DfSdk
Reg      HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                            0
Reg      HKLM\SYSTEM\ControlSet011\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                         0x91 0xDB 0xB8 0xA3 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{82AA222C-DDAF-2AA5-D0C6-FB170D5DBC30}                                                                                                            

---- EOF - GMER 2.1 ----
         

Danke!

Hallo,

Ich hatte es kurz danach gemerkt, als Inhalte in Ordnern auf dem USB-Stick sich in neuen Fenstern öffneten und neue Dateien nur noch als Verknüpfungen angezeigt wurden.

Ab sofort nichts mehr auf diesem USB-Stick öffnen, das führt immer zu einer Re-Infektion. Wir werden den USB-Stick dann anschliessend säubern, nachdem die Malware vom Rechner runter ist.

Zudem laufen zahlreiche aktive Prozesse ohne Benutzernamen und Beschreibung, die sich nicht mehr beenden lassen (u.A. csrss.exe, winlogon.exe,

Das sind Systemprozesse, die du auch gar nicht zu beenden versuchen solltest... Dass du keine Details (wie Beschreibung) davon siehst, liegt daran, dass du als Benutzer nicht die nötigen Rechte hast. Starte den Taskmanager als Administrator, dann siehst du es.


Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

(Microsoft Corporation) C:\Windows\system32\wscript.exe
HKLM\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
C:\Users\JéRaThie\AppData\Local\Temp\SergeLeLama.vbs
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs ()
Reboot:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3

Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Hey,

Vielen, vielen Dank für Deine Antwort!

Ich hatte den Stick danach formatiert, kann da trotzdem noch was drauf sein? Aber gut, wird gemacht.
Und hm, normalerweise bin ich auch als Administrator angemeldet. Es hatte sich aber auch in den Tagen nach der Infektion irgendwann die Benutzerkontensteuerung von Vista von selbst eingeschalten. Nachdem die nun wieder aus ist, werden mir die Prozesse tatsächlich wieder normal angezeigt.

Hier der fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-07-2014
Ran by JéRaThie at 2014-07-28 19:50:17 Run:3
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
(Microsoft Corporation) C:\Windows\system32\wscript.exe
HKLM\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
C:\Users\JéRaThie\AppData\Local\Temp\SergeLeLama.vbs
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs"  <===== ATTENTION
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs ()
Reboot:
*****************

C:\Windows\system32\wscript.exe => No running process found
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SergeLeLama => value deleted successfully.
C:\Users\JéRaThie\AppData\Local\Temp\SergeLeLama.vbs => Moved successfully.
HKU\S-1-5-21-502464258-2623245878-921248753-1000\Software\Microsoft\Windows\CurrentVersion\Run\\SergeLeLama => value deleted successfully.
C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====
         

Bei ESET hatte ich vergessen, dass ich das Programm nach der Infektion schon einmal hatte laufen lassen, tut mir leid, dass ich das nicht zuvor erwähnt hatte. Damals hatte ich auch nicht den Haken bei "Entdeckte Bedrohungen entfernen" entfernt... Hoffe, das verkompliziert die Sache nicht. Hier nun aber der Log, da sind die alten Einträge mit dabei:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=17805
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-09 12:47:28
# local_time=2014-04-09 02:47:28 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 4700611 234528354 0 0
# scanned=111234
# found=6
# cleaned=0
# scan_time=7652
sh=63D78C0254010DE6FCDF7A5596F543882EF5345B ft=0 fh=0000000000000000 vn="Java/Agent.DJ trojan" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\77ad73e8-2fb40d5f"
sh=10825AE5BA011F2EC26F215B6E38809B9EA5241F ft=0 fh=0000000000000000 vn="a variant of Java/Agent.DN trojan" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\293bfab8-71189031"
sh=D6A17A879F284084C472D38387ECDB08FD190403 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\javapi\v1.0\jar\Edu.jar-50873985-6441dc61.zip"
sh=106DA712DF7E8BFD7F66DB0EA34BAE05DAD64993 ft=0 fh=0000000000000000 vn="Java/Agent.DW trojan" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\javapi\v1.0\jar\field.jar-602032d-5d3ade22.zip"
sh=A9F10969FF89E08911A0E0BBC3CBBB35579D5BC8 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\javapi\v1.0\jar\g43kb6j34kblq6jh34kb6j3kl4.jar-644ae6b0-3e0df620.zip"
sh=333EB3C82BCF081B82CF25DB81C0B9A45653F2F0 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-0507.DH trojan" ac=I fn="C:\Users\JéRaThie\AppData\LocalLow\Sun\Java\Deployment\cache\javapi\v1.0\jar\Gert.jar-44aad177-30f1074f.zip"
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=17817
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-09 06:41:47
# local_time=2014-04-09 08:41:47 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 4761471 234592814 0 0
# scanned=362754
# found=144
# cleaned=74
# scan_time=13530
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz13D7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz163E.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz1BA5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz209.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz218A.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz23F2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz2710.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz2958.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz2FBB.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz3196.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz34D3.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz3B26.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz3D7E.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz42F4.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz45DA.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz48F9.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz4B50.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz4E5F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz570A.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz58E5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz5C32.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz5F76.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz6275.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz64BD.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz6D39.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz7048.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz729F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz75BE.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz7912.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz7E59.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz8043.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz85C.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz86C5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz89D4.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz8C0C.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz926F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz9488.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz9797.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trz99EF.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzA051.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzA47.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzA5A8.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzA7A2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzAB9D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzAE14.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzB123.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzB35B.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzB9BE.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzBBD7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzBEE6.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzC14D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzC48D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzC7A0.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzCCF7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzD2EC.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzD573.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzD84.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzD872.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzDABA.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzE10D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzE307.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzE635.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzE87D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzEC69.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzEEEF.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzF446.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzFA3B.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzFCC.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzFCC2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan" ac=I fn="C:\Users\All Users\trzFFC1.tmp"
sh=F044F43AEAA663DC686C64AEAF318D899C07BC78 ft=1 fh=cc1e696a019e27ed vn="a variant of Win32/Toolbar.CrossRider.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.exe"
sh=8E5185395404E9F5A74D488ED6026A24F021E273 ft=1 fh=c71c00115cf72abf vn="a variant of Win32/Toolbar.CrossRider.F potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-CGui.exe"
sh=BCB8B7981ACCB78D56B1F8A3C62B111569932C06 ft=1 fh=5aabb72166a51fa7 vn="a variant of Win32/Toolbar.CrossRider.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\Premiumplay Codec-C\Uninstall.exe"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz13D7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz163E.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz1BA5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz209.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz218A.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz23F2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz2710.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz2958.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz2FBB.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz3196.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz34D3.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz3B26.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz3D7E.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz42F4.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz45DA.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz48F9.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz4B50.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz4E5F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz570A.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz58E5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz5C32.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz5F76.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz6275.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz64BD.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz6D39.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz7048.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz729F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz75BE.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz7912.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz7E59.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz8043.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz85C.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz86C5.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz89D4.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz8C0C.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz926F.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz9488.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz9797.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trz99EF.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzA051.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzA47.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzA5A8.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzA7A2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzAB9D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzAE14.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzB123.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzB35B.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzB9BE.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzBBD7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzBEE6.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzC14D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzC48D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzC7A0.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzCCF7.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzD2EC.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzD573.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzD84.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzD872.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzDABA.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzE10D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzE307.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzE635.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzE87D.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzEC69.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzEEEF.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzF446.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzFA3B.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzFCC.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzFCC2.tmp"
sh=44665EBAAF35CE16109186254933DAF00DFAA5D8 ft=1 fh=5ba44f7429a2fe59 vn="Win32/PSW.Papras.CX trojan (cleaned by deleting - quarantined)" ac=C fn="C:\ProgramData\trzFFC1.tmp"
sh=2F7B59494D506357EE32F7C885252130B6196764 ft=1 fh=f06fd9d453329f9f vn="Win32/Toolbar.Conduit potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\JéRaThie\Dropbox\Programme (auf festplatte)\FreeAudioDub1.7.9.908.exe"
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=17829
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-10 04:32:07
# local_time=2014-04-10 06:32:07 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 94 28005 3829863 20763 0
# compatibility_mode=5892 16776574 100 100 4843690 234671433 0 0
# scanned=356041
# found=1
# cleaned=1
# scan_time=25210
sh=B9A96D9AE94C4B42CA5499933F6DF218B3903768 ft=1 fh=966b3592656dc188 vn="a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application (deleted (after the next restart) - quarantined)" ac=C fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=17919
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-17 10:03:58
# local_time=2014-04-17 12:03:58 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 11692 235252944 0 0
# scanned=353918
# found=2
# cleaned=2
# scan_time=10792
sh=72A0A828713BF36BC1F7DE153146DD2E86A33E34 ft=1 fh=4bb568ad284dd1af vn="a variant of Win32/DownloadSponsor.A potentially unwanted application (deleted - quarantined)" ac=C fn="C:\$RECYCLE.BIN\S-1-5-21-502464258-2623245878-921248753-1000\$RPF47AT.exe"
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R potentially unwanted application (deleted - quarantined)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\JéRaThie\AppData\Roaming\OpenCandy\48CD027DABEB4258A2B83DA48283035C\search_protect_global.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=19193
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-16 12:27:22
# local_time=2014-07-16 02:27:22 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 754827 169890932 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 53893 242994348 0 0
# scanned=154101
# found=38
# cleaned=0
# scan_time=3948
sh=D5F81E940DF0CA88EE270E1B9A597FEFFCABAE81 ft=1 fh=a38c288313053c89 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\FormatFactory\FFModules\Package\Ask\AskPIP_FF_.exe"
sh=FC77173FA92C79538E92FEA76847F49271181A44 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Users\JéRaThie\AppData\Local\Temp\SergeLeLama.vbs"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\JéRaThie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=FC77173FA92C79538E92FEA76847F49271181A44 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs"
sh=32132DD81EB40C467459166324C6F32AF95282DC ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\.fseventsd.lnk"
sh=5540BBB015BCE85CF41799D4882252059448EF2D ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\.lnk"
sh=921E0DB7BC43053D5C160882A036C86D35B48B6D ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\.Spotlight-V100.lnk"
sh=8C71B1A5AA4FBB6ECB369EBCA218AFB476374D34 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\.Trashes.lnk"
sh=43355AE136A9C170A233A88F1A37B83D97571B6B ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\1.lnk"
sh=126AB07B858689274FBDA5D5D21B878D7A9F59EE ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\10957975-senza-soluzione-di-continuita-etnica-vector-doodle-criterio-monocromatica.lnk"
sh=9EE890199F71CFDA805EBF3B265F8A251E2D83A1 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\17441.lnk"
sh=01BDFDCE89C796355E51704C9C6A116F02125645 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\17443.lnk"
sh=5683D121AE1675FA03A485A95F4D32F083576E69 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\17445.lnk"
sh=8754F10D30D662A9A2DE04FEE774C6C3A4FA8F46 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\200810261375471877801.lnk"
sh=75569D14830D9EF93E1FC1064EEC2E068843CA11 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\20112242163557777801.lnk"
sh=39260917E4FF35CE55D38E1956F0E56AFDC9BB54 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\20112242164217177801.lnk"
sh=AC1202E70D4A0C86848D1A94E2FA54E82EFDD887 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\barcelona valladolid - copia.lnk"
sh=C7AC1112CB03ACF0D968064463BC4EC5059F027E ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\barcelona valladolid.lnk"
sh=D632024D65306BB1C6517DC579725FB527BF29BF ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\business cards tarjetas visita Olympia.lnk"
sh=0486867453D955BF05CA03E0929D6EF17A091EFE ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\buzon.lnk"
sh=D4F6E51F1736F5588913CC556CD86F6A34D9D4EF ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\b_1335242283160.lnk"
sh=6F9F2758ABAC44276EE59BB66EEBB20F9EB917F5 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\celebration_floral_vector_pattern.lnk"
sh=0AD52735E4677E7A894B00B906E83BFCBD16FDC0 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\d12 b.lnk"
sh=B29F082B1568D3EF61D5FEC3B0EC4CB57CF8A6CA ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\depositphotos_1104872-Helix-seamless-pattern.lnk"
sh=AF390C4FEDC0CCD572069E5B1E69CB6DADFF90BA ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\depositphotos_1598750-Vector-Seamless-floral-twirled-pattern.lnk"
sh=E8F8617F9C632A35714C58C68D2C0B99E6C4F589 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\depositphotos_3902031-Seamless-vector-pattern-wallpaper.lnk"
sh=5686C5788390B4FAD1F54320465AAEF4509898D4 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\FRONTE e INDICE.lnk"
sh=DAA78D1EB7D852F5EE6E1BC4D01BC6BD88603CCA ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\indice buono tesi.lnk"
sh=E9B3AA6BF9CA9FD0B0DCFD835C8C0EE02BEA880E ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\ITALIANO.lnk"
sh=4E8AAC1C97EB0B1AF09E5B81F0727DEDF767C181 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\LOGO OLYMPIA.lnk"
sh=54F7D3806D0B1683740522BE5D9A6D49ED903556 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\para doug.lnk"
sh=B12FCF8C3D95FA95FD15D82DA71A63F350D85A82 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\RyanairBoardingPass (3).lnk"
sh=925416CED5E751B1B8A98C55FDA9A85DF361C5B4 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\TaBS & Docs.lnk"
sh=6BD670E4221F444F0D99152F89B119405D0A05BC ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\tese.lnk"
sh=A030D25A0551A0754314A932DA457BB37BB8EBB6 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\TESI FINALEEE!!!.lnk"
sh=C399364F4AF0A3F2D6773824BA4D45817C9A5E89 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\Uni.lnk"
sh=95F64945BDF79DB1C2902D548B565F4F79016BB4 ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\vector-patterns.lnk"
sh=E28AE93E55D62EA4646B805155F59E85D48D419B ft=0 fh=0000000000000000 vn="LNK/Agent.AK Trojaner" ac=I fn="C:\Users\JéRaThie\Desktop\Doug USB\viaje a Grecia.lnk"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c24b9ed1e8dad84385898e784f26a89e
# engine=19196
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-16 09:54:57
# local_time=2014-07-16 11:54:57 (+0100, Mitteleuropäische Sommerzeit   )
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 788882 169924987 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 87948 243028403 0 0
# scanned=394191
# found=4
# cleaned=4
# scan_time=12386
sh=D5F81E940DF0CA88EE270E1B9A597FEFFCABAE81 ft=1 fh=a38c288313053c89 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\FormatFactory\FFModules\Package\Ask\AskPIP_FF_.exe"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner (Gesäubert durch Löschen (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Users\JéRaThie\AppData\Local\Temp\SergeLeLama.vbs"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\JéRaThie\AppData\Local\Temp\OCS\ocs_v71b.exe"
sh=FC77173FA92C79538E92FEA76847F49271181A44 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetesets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
         

Und nun nochmal FRST:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by JéRaThie (administrator) on SEGUNDOSOL on 29-07-2014 14:52:51
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
( ) C:\Windows\System32\lxczcoms.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
() E:\Extras\DesktopCoral\DesktopCoral.exe
(Dropbox, Inc.) C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [238592 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [422400 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4086432 2014-07-06] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BambooCore] => C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
Winlogon\Notify\WB: E:\Extras\WindowBlinds\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -update activex 
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [Desktop Coral] => E:\Extras\DesktopCoral\DesktopCoral.exe [2303488 2008-11-26] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {45fda274-199a-11df-ab98-0026222e4b24} - G:\StartPortableApps.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {55598bdb-ab70-11de-88a4-0026222e4b24} - D:\Eautorun.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {fc268444-23b4-11df-a7e9-001e65103b4e} - VLkmed0349-v-sd90jk129-0G\1490304-609127988309-709234\taskmgr.exe
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteTray.lnk
ShortcutTarget: EvernoteTray.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: "DropboxExt1" -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt2" -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt3" -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt4" -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt5" -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt6" -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt7" -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: "DropboxExt8" -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers-x32: "DropboxExt1" -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt2" -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt3" -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt4" -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt5" -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt6" -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt7" -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: "DropboxExt8" -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/stg_drm.ocx
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/armhelper.ocx
DPF: HKLM-x32 {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 139.18.25.3 139.18.1.2

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @google.com/npPicasa2,version=2.0.0 - C:\Program Files (x86)\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\JéRaThie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\libdivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdivx32.dll (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ssldivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-02-06]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-14]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-10-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-04-13]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Shiretoko\firefox.exe

Chrome: 
=======
CHR HomePage: hxxp://my.jolicloud.com/#!/dashboard
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (OkayFreedom) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bckipplcmnfhblnpibpbehenelnkpecd [2014-07-28]
CHR Extension: (WOT) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-07-24]
CHR Extension: (Snip-Me - Amazon-Preisalarm) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggbcajkaanddkocabpldmeomjdlgjpag [2014-04-11]
CHR Extension: (AdBlock) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-11]
CHR Extension: (avast! Online Security) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-11]
CHR Extension: (Pearltrees) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjcccdngnaailhnoflbeficiokgcfaah [2014-07-24]
CHR Extension: (vGet Extension (Video Downloader, DLNA)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hniladkejehjfchadikcbjmgjaogciic [2014-04-11]
CHR Extension: (StayFocusd) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji [2014-04-11]
CHR Extension: (InvisibleHand) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lghjfnfolmcikomdjmoiemllfnlmmoko [2014-07-24]
CHR Extension: (Jolidrive) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfakdllpdfjjbfommlcnfkedmbigkfdo [2014-07-23]
CHR Extension: (Pocket (formerly Read It Later)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2014-04-11]
CHR Extension: (Google Wallet) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Quick Scroll) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc [2014-04-11]
CHR Extension: (Evernote Web Clipper) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-04-27]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-07-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems) [File not signed]
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-07-06] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-06-26] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [627992 2013-12-17] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\tinnoadb.sys [31744 2010-03-12] (Google Inc) [File not signed]
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64752 2014-07-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-06] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2014-07-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-09-09] ()
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-01-04] (Samsung Electronics)
S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4AMD64.sys [22176 2012-04-02] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-09-09] ()
R0 LPCFilter; C:\Windows\SysWOW64\DRIVERS\LPCFilter.sys [32040 2008-05-07] (COMPAL ELECTRONIC INC.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-09-27] () [File not signed]
S3 cpuz130; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz132; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 UnlockMonitor; \??\C:\Program Files (x86)\UnLock IT\v3\UnlockMonitor-x64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 14:51 - 2014-07-29 14:51 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Diagnostik.odt#
2014-07-29 11:06 - 2014-07-29 11:06 - 00001396 _____ () C:\Windows\PFRO.log
2014-07-28 20:54 - 2014-07-28 20:54 - 00003337 _____ () C:\Users\JéRaThie\Desktop\was tun.txt
2014-07-28 20:38 - 2014-07-28 20:48 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\PDF Architect 2
2014-07-28 20:36 - 2014-07-28 20:36 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\PDFCreator
2014-07-28 20:34 - 2014-07-28 20:34 - 00000829 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-07-28 20:33 - 2014-07-28 20:43 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-07-28 20:33 - 2014-07-28 20:33 - 00000000 ____D () C:\Users\JéRaThie\Documents\PDF Architect 2
2014-07-28 20:33 - 2014-07-28 20:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-07-28 20:31 - 2014-07-28 20:34 - 00000000 ____D () C:\Program Files\PDFCreator
2014-07-28 20:31 - 2014-07-28 20:31 - 00000753 _____ () C:\Users\Public\Desktop\PDFCreator.lnk
2014-07-28 20:31 - 2014-07-28 20:31 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\pdfforge
2014-07-28 20:31 - 2014-07-28 20:31 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-07-28 20:26 - 2014-07-28 20:26 - 25021848 _____ (pdfforge ) C:\Users\JéRaThie\Downloads\PDFCreator-1_9_4-setup.exe
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 01:32 - 2014-07-29 14:46 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 19:14 - 2014-07-25 19:40 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-23 17:56 - 2014-07-23 19:01 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 18:18 - 2014-07-24 12:20 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-16 18:18 - 2014-07-24 11:22 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:05 - 2014-07-16 00:06 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-10 15:46 - 2014-06-07 06:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 15:46 - 2014-06-07 05:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 15:46 - 2014-06-07 04:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 15:46 - 2014-06-07 04:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 15:46 - 2014-06-07 04:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 04:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 15:46 - 2014-06-07 04:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-10 15:46 - 2014-06-07 04:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 04:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 04:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 04:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-10 15:46 - 2014-06-07 04:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 15:46 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 15:46 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 15:46 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 15:46 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 15:46 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 15:46 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-07-10 15:46 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-10 15:46 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-07-10 15:46 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 15:45 - 2014-06-07 02:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 15:45 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 15:45 - 2014-06-06 09:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 15:45 - 2014-05-30 09:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-07 01:53 - 2014-07-12 21:10 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-29 20:22 - 2014-06-29 20:38 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 20:12 - 2014-07-14 19:25 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-29 14:52 - 2014-04-17 08:56 - 00000000 ____D () C:\Users\JéRaThie\Downloads\Malware-removal
2014-07-29 14:52 - 2014-04-16 15:22 - 00000000 ____D () C:\FRST
2014-07-29 14:51 - 2014-07-29 14:51 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Diagnostik.odt#
2014-07-29 14:47 - 2012-11-30 15:33 - 01655700 _____ () C:\Windows\WindowsUpdate.log
2014-07-29 14:46 - 2014-07-24 01:32 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-29 14:42 - 2011-09-17 15:45 - 00000000 ___RD () C:\Users\JéRaThie\Dropbox
2014-07-29 14:42 - 2011-09-17 15:41 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Dropbox
2014-07-29 14:41 - 2012-08-21 08:14 - 00003896 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-07-29 14:40 - 2012-08-13 23:16 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-29 14:40 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-29 14:40 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-29 14:40 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-29 13:10 - 2006-11-02 17:42 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-29 12:40 - 2012-08-13 23:16 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-29 12:32 - 2012-07-05 21:22 - 00001150 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA.job
2014-07-29 12:13 - 2012-04-23 17:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-29 11:06 - 2014-07-29 11:06 - 00001396 _____ () C:\Windows\PFRO.log
2014-07-29 00:32 - 2012-07-05 21:22 - 00001128 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core.job
2014-07-28 22:00 - 2008-01-21 13:10 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-28 22:00 - 2008-01-21 13:09 - 00674274 _____ () C:\Windows\system32\perfh007.dat
2014-07-28 22:00 - 2008-01-21 13:09 - 00146254 _____ () C:\Windows\system32\perfc007.dat
2014-07-28 20:54 - 2014-07-28 20:54 - 00003337 _____ () C:\Users\JéRaThie\Desktop\was tun.txt
2014-07-28 20:48 - 2014-07-28 20:38 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\PDF Architect 2
2014-07-28 20:43 - 2014-07-28 20:33 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-07-28 20:36 - 2014-07-28 20:36 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\PDFCreator
2014-07-28 20:34 - 2014-07-28 20:34 - 00000829 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-07-28 20:34 - 2014-07-28 20:31 - 00000000 ____D () C:\Program Files\PDFCreator
2014-07-28 20:33 - 2014-07-28 20:33 - 00000000 ____D () C:\Users\JéRaThie\Documents\PDF Architect 2
2014-07-28 20:33 - 2014-07-28 20:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-07-28 20:31 - 2014-07-28 20:31 - 00000753 _____ () C:\Users\Public\Desktop\PDFCreator.lnk
2014-07-28 20:31 - 2014-07-28 20:31 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\pdfforge
2014-07-28 20:31 - 2014-07-28 20:31 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-07-28 20:31 - 2012-05-03 20:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-07-28 20:26 - 2014-07-28 20:26 - 25021848 _____ (pdfforge ) C:\Users\JéRaThie\Downloads\PDFCreator-1_9_4-setup.exe
2014-07-28 12:33 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\vlc
2014-07-26 19:13 - 2014-06-28 18:12 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Skyrim
2014-07-26 18:57 - 2014-06-28 19:18 - 00000813 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2014-07-26 18:57 - 2014-06-28 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-07-26 18:57 - 2014-06-28 19:18 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
2014-07-25 19:40 - 2014-07-23 19:14 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-25 15:20 - 2011-09-17 15:41 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-24 12:20 - 2014-07-16 18:18 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-24 12:18 - 2014-04-09 00:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-24 11:28 - 2012-09-12 11:31 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Spotify
2014-07-24 11:23 - 2013-01-28 15:13 - 00000000 ____D () C:\Users\Gast
2014-07-24 11:23 - 2011-07-03 04:44 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Rainmeter
2014-07-24 11:23 - 2009-09-09 16:43 - 00000000 ____D () C:\Users\JéRaThie
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\spool
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-07-24 11:23 - 2006-11-02 14:33 - 79429632 _____ () C:\Windows\system32\config\software_previous
2014-07-24 11:23 - 2006-11-02 14:33 - 50069504 _____ () C:\Windows\system32\config\system_previous
2014-07-24 11:22 - 2014-07-16 18:18 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-24 11:22 - 2014-04-10 11:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 11:22 - 2013-08-14 20:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 11:22 - 2010-08-02 09:50 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-24 11:22 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\registration
2014-07-24 11:16 - 2006-11-02 14:33 - 61865984 _____ () C:\Windows\system32\config\components_previous
2014-07-24 11:16 - 2006-11-02 14:33 - 00057344 _____ () C:\Windows\system32\config\sam_previous
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 03:09 - 2010-10-09 00:47 - 00000000 ____D () C:\ProgramData\Origin
2014-07-24 03:01 - 2013-08-14 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 02:58 - 2012-05-31 20:32 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 21:14 - 2006-11-02 14:33 - 00360448 _____ () C:\Windows\system32\config\default_previous
2014-07-23 21:14 - 2006-11-02 14:33 - 00024576 _____ () C:\Windows\system32\config\security_previous
2014-07-23 21:09 - 2014-06-03 02:39 - 00024760 _____ () C:\Users\JéRaThie\Desktop\Diagnostik.odt
2014-07-23 21:09 - 2014-04-14 17:46 - 00022464 _____ () C:\Users\JéRaThie\Desktop\BiWi V - Seminar 1.odt
2014-07-23 19:40 - 2012-09-12 11:33 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Spotify
2014-07-23 19:28 - 2014-06-19 17:36 - 00000000 ____D () C:\Users\JéRaThie\Desktop\master thesis
2014-07-23 19:23 - 2014-05-07 14:45 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Farben
2014-07-23 19:01 - 2014-07-23 17:56 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 23:01 - 2010-09-18 17:29 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-07-16 22:54 - 2010-10-22 17:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-07-16 22:54 - 2010-10-22 17:05 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-07-16 22:53 - 2011-01-22 14:38 - 00000000 ____D () C:\Program Files (x86)\Iomega
2014-07-16 22:53 - 2009-06-05 17:07 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\Public\Documents\Audible
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\JéRaThie\Documents\Audible
2014-07-16 22:44 - 2014-06-05 18:42 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-07-16 19:17 - 2014-04-09 23:26 - 00000000 ____D () C:\AdwCleaner
2014-07-16 00:09 - 2013-11-30 01:29 - 00000000 ____D () C:\Users\JéRaThie\Downloads\sortieren_alt
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:06 - 2014-07-16 00:05 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-15 19:21 - 2012-02-07 12:15 - 00000248 _____ () C:\lxcz.log
2014-07-14 19:25 - 2014-06-29 20:12 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-12 21:10 - 2014-07-07 01:53 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-11 20:36 - 2012-05-03 20:40 - 00110776 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-07-11 03:29 - 2006-11-02 17:21 - 05120800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 03:24 - 2006-11-02 17:07 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 03:06 - 2014-04-17 02:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 03:02 - 2006-11-02 14:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 22:51 - 2011-05-22 00:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-06 23:39 - 2010-09-17 00:59 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-07-06 23:38 - 2014-04-25 16:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-07-06 23:38 - 2011-04-13 02:03 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-07-06 23:38 - 2011-01-19 02:24 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-07-06 23:38 - 2010-09-17 00:59 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00065264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00064752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswrdr.sys
2014-07-03 23:04 - 2009-09-14 14:35 - 00213504 _____ () C:\Users\JéRaThie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-03 23:02 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\dvdcss
2014-06-30 09:28 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\Branding
2014-06-29 22:58 - 2014-04-15 00:18 - 00000132 _____ () C:\Users\JéRaThie\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-06-29 20:38 - 2014-06-29 20:22 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 15:22 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\Documents\Nexus Mod Manager
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-29 04:07 - 2014-04-09 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-29 04:07 - 2014-04-09 00:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 

Some content of TEMP:
====================
C:\Users\JéRaThie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp5bwlwz.dll
C:\Users\JéRaThie\AppData\Local\Temp\Nexus%20Mod%20Manager-0.51.0.exe
C:\Users\JéRaThie\AppData\Local\Temp\Quarantine.exe
C:\Users\JéRaThie\AppData\Local\Temp\rtdrvmon.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-29 14:46

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Sieht gut aus.


Die Version deines Adobe PDF Readers ist veraltet, wir müssen ihn updaten:

• Deinstalliere bitte deine aktuelle Version von Adobe Reader über

  Start --> Systemsteuerung --> Software (bei Windows XP)
  Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Windows 7)

• Besuche diese Seite von Adobe.
• Entferne gegebenenfalls den Haken bei McAfee Security Scan bzw. Google Chrome.
• Drücke auf Jetzt herunterladen und installiere die neuste Version.

Cleanup

Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.

1. Bei MBAM würd ich dir unbedingt empfehlen, es zu behalten und wöchentlich einen Quick-Scan durchzuführen. Wenn du es nicht weiter verwenden möchtest, kannst du es jetzt normal über die Systemsteuerung deinstallieren.
2. Auch den ESET Online Scanner kannst du behalten, um ab und zu (monatlich) für eine Zweitmeinung dein System damit zu scannen. Falls du ESET deinstallieren möchtest, dann kannst du das ebenfalls über die Systemsteuerung tun.
3. Downloade dir bitte auf jeden Fall DelFix auf deinen Desktop.
   • Schliesse alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • DelFix entfernt u.a. alle von uns verwendeten Programme und löscht sich anschliessend selbst.
4. Wenn jetzt noch etwas übriggeblieben ist, dann kannst du es einfach manuell löschen.

>> OK <<
Wir sind durch, deine Logs sehen für mich im Moment sauber aus.

Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst.

Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann.




Epilog: Tipps, Dos & Don'ts

Aktualität von System und Software

Das Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:

• Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
• Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Auch die installierte Software sollte immer in der aktuellsten Version vorliegen.
Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.

• Mit diesem kleinen Plugin-Check kannst du regelmässig diese Komponenten auf deren Aktualität überprüfen.
• Achte auch darauf, dass alte, nicht mehr verwendete Versionen deinstalliert sind.
• Optional: Das Programm Secunia Personal Software Inspector kann dich dabei unterstützen, stets die aktuellen Versionen sämtlicher installierter Software zu nutzen.

Sicherheits-Software

Eine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt).
Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.

• Nutze einen Virenscanner mit Hintergrundwächter mit stets aktueller Datenbank. Welches Produkt gewählt wird, spielt keine so entscheidende Rolle. Wenn du ein kommerzielles Programm kaufen möchtest, kann ich dir Emsisoft Anti-Malware empfehlen (die Freeware-Version davon reicht aber nicht, denn die hat keinen Hintergrundwächter). Bevorzugst du ein kostenloses Produkt, dann ist Avast! Free Antivirus eine gute Alternative.
  Betreibe aber keinesfalls zwei Wächter parallel, die würden sich gegenseitig behindern.
• Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
• Zusätzlich zum Virenscanner kannst du dein System regelmässig mit einem On-Demand Antimalwareprogramm scannen. Empfehlenswert ist die Free-Version von Malwarebytes Anti-Malware. Vor jedem Scan die Datenbank updaten.
• Optional: Das Programm Sandboxie führt Anwendungen in einer isolierten Umgebung ("Sandkasten") aus, so dass keine Änderungen am System vorgenommen werden können. Wenn du deinen Browser darin startest, vermindert sich die Chance, dass beim Surfen eingefangene Malware sich dauerhaft im System festsetzen kann.
• Optional: Das Addon WOT (web of trust) warnt dich vor einer als schädlich gemeldeten Website, bevor sie geladen wird. Für verschiedene Browser erhältlich.

Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt.
Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:

• NoScript verhindert standardmässig das Ausführen von aktiven Inhalten (Java, JavaScript, Flash, ..) für sämtliche Websites. Du kannst selber nach dem Prinzip einer Whitelist festlegen, welchen Seiten du vertrauen und Scripts erlauben willst, auch temporär.
• Adblock Plus blockt die meisten Werbebanner weg. Solche Banner können nebst ihrer störenden Erscheinung auch als Infektionsherde fungieren.

(Un-)Sicheres Verhalten im Internet

Nebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.

Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.

• Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher (und ein beliebter) Weg, um Malware zu verbreiten.
• Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kannst du dir nie sicher sein, ob auch wirklich drin ist, was drauf steht.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).

• Surfe mit Vorsicht und lass dich nicht von irgendwie interessant erscheinenden Elementen zu einem vorschnellen Klick verleiten. Lass dich nicht von Popups täuschen, die aussehen wie System- oder Virenmeldungen.
• Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo deine Daten eingeben.
• Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst du von einem deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant oder skandalös tönt, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und du solltest nicht denselben Fehler machen.
• Lass die Dateiendungen anzeigen, so dass du dich nicht täuschen lässt, wenn eine ausführbare Datei über ein doppelte Dateiendung kaschiert wird, z.B. Nacktfoto.jpg.exe.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.

• Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
• Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen fürs Programm irrelevanten Ergänzungen.

Allgemeine Hinweise

Abschliessend noch ein paar grundsätzliche Bemerkungen:

• Dein Benutzerkonto für den alltäglichen Gebrauch sollte nicht über Administratorenrechte verfügen. Nutze ein Konto mit eingeschränkten Rechten (Windows XP) bzw. aktiviere die Benutzerkontensteuerung (UAC) auf der höchsten Stufe (Windows Vista / 7).
• Erstelle regelmässig Backups deiner Daten und Dokumente auf externen Datenträgern, bei wichtigen Dateien mindestens zweifach. Nicht nur ein Malwarebefall kann schmerzhaften Datenverlust nach sich ziehen sondern auch ein gewöhnlicher Festplattendefekt.
• Die Autorun/Autoplay-Funktion stellt ein Risiko dar, denn sie ermöglicht es, dass beispielsweise beim Einstecken eines entsprechend infizierten USB-Sticks der Befall auf den Rechner überspringt. Überlege dir, ob du diese Funktion nicht besser deaktivieren möchtest.
• Wähle deine Passwörter gemäss den gängigen Regeln, um besser gegen Brute-Force- und Wörterbuchattacken gewappnet zu sein. Benutze jedes deiner Passwörter nur einmal und ändere sie regelmässig.
• Der Nutzen von Registry-Cleanern zur Performancesteigerung ist umstritten. Auf jeden Fall lässt sich damit grosser Schaden anrichten, wenn man nicht weiss, was man tut. Wir empfehlen deshalb, die Finger von der Registry zu lassen. Um von Zeit zu Zeit die temporären Dateien zu löschen, genügt TFC.

Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Hey Leo,

Wow, das wars schon? Dann noch einmal ein großes Dankeschön! Ich werde mir die Tipps zu Herzen nehmen und hoffe auch, dass ich so schnell nicht erneut Hilfe benötige.

Nur noch eins: kann ich denn nun davon ausgehen, dass ich meinen USB-Stick nach dem Formatieren wieder normal benutzen kann?

Als Student hab ich nicht allzu viel, aber eine kleine Spende ist auf jeden Fall unterwegs!

Nur noch eins: kann ich denn nun davon ausgehen, dass ich meinen USB-Stick nach dem Formatieren wieder normal benutzen kann?

Ja. Am besten du formatierst ihn jetzt vom gesäuberten Rechner nochmals und dann kann da nichts mehr passieren.

Als Student hab ich nicht allzu viel, aber eine kleine Spende ist auf jeden Fall unterwegs!

Vielen Dank dafür!


Freut mich, dass wir helfen konnten.

Falls du dem Forum noch Verbesserungsvorschläge, Kritik oder ein Lob mitgeben möchtest, kannst du das hier tun.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.