seid ca. 1 woche bekomme ich "Mailerdamon" Mails die ich vorerst immer in Junk geschoben habe. Gestern bekam ich dann die Mail von der Telekom das ich spammails versende und mein Mailausgang vorerst gesperrt ist.
Ich habe Kasperky in der neuesten Version drauf und der findet nichts.
Vielen Dank im vorraus für eure Hilfe


Hier die Logs als zip, da zu lang :

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

ok. dann teil ich sie auf :

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Sabine at 2014-09-15 08:06:42
Running from C:\Users\Sabine\Desktop\Malware entfernen
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 0.9.0.2 - Lavasoft)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.11 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 2.5.1.17730 - Adobe Systems Inc.) Hidden
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.) Hidden
Adobe Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5.5 Master Collection (HKLM-x32\...\{D57FC112-312E-4D70-860F-2DB8FB6858F0}) (Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Adobe Story (HKLM-x32\...\com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.0.571 - Adobe Systems Incorporated)
Adobe Story (x32 Version: 1.0.571 - Adobe Systems Incorporated) Hidden
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1) (Version: 2.0 Build 230 - Adobe Systems Incorporated.)
Adobe Widget Browser (x32 Version: 2.0.230 - Adobe Systems Incorporated.) Hidden
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Alice Madness Returns (HKLM-x32\...\{93A3AB24-36E8-41BA-80C6-CCEC237836DC}) (Version: 1.0.0.0 - Electronic Arts)
Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version:  - Amazon)
Anki (HKLM-x32\...\Anki) (Version:  - )
ANWB Waterkaart Nederland - 2014 (HKLM-x32\...\{EF6BE627-DE4B-47D1-BF5D-6D13ACD02F79}) (Version: 0.07.01 - ANWB b.v.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS Xonar DG Audio Driver (HKLM\...\C-Media Oxygen HD Audio Driver) (Version:  - )
AusweisApp (HKLM-x32\...\{3BA47CB9-CEEE-48D3-A0BC-776D1FA1F761}) (Version: 1.12.0 - OpenLimit SignCubes AG)
Auto Gordian Knot 2.55 (HKLM-x32\...\AutoGK) (Version: 2.55 - len0x)
AutoIt v3.3.8.1 (HKLM-x32\...\AutoItv3) (Version:  - AutoIt Team)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version:  - )
AVS Audio Editor 7.1 (HKLM-x32\...\AVS Audio Editor_is1) (Version:  - Online Media Technologies Ltd.)
AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version:  - Online Media Technologies Ltd.)
AVS Video Converter 8 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: 8.4.2.541 - Online Media Technologies Ltd.)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
Beneton Movie GIF 1.1.2 (HKLM-x32\...\Beneton Movie GIF_is1) (Version:  - Beneton Software)
Bewerbungsfoto-/Passbild-Generator v3.6a (HKLM-x32\...\Passbild-Generator_is1) (Version:  - )
BIT.TRIP RUNNER (HKLM-x32\...\Steam App 63710) (Version:  - Gaijin Games)
Blender (HKLM\...\Blender) (Version: 2.63-release - Blender Foundation)
Body Fat Scale 1.0 (HKLM-x32\...\Body Fat Scale_is1) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J5910DW (HKLM-x32\...\{830F55B6-4398-4B72-A0D8-66397B902C0E}) (Version: 1.1.1.0 - Brother Industries, Ltd.)
calibre (HKLM-x32\...\{FEFD4E74-85EE-4BA6-AD02-E0F99BC3F51E}) (Version: 1.31.0 - Kovid Goyal)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.5.0.3 - Canon Inc.)
Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.6.1.6 - Canon Inc.)
Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\RAW Image Task) (Version: 3.2.0.10 - Canon Inc.)
Canon Utilities CameraWindow (HKLM-x32\...\CameraWindowLauncher) (Version: 7.1.0.2 - Canon Inc.)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (HKLM-x32\...\CameraWindowDVC6) (Version: 6.4.2.16 - Canon Inc.)
Canon Utilities Digital Photo Professional 3.3 (HKLM-x32\...\DPP) (Version: 3.3.0.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.3.0.2 - Canon Inc.)
Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 6.4.0.5 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.21.45 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.2.0.1 - Canon Inc.)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\RemoteCaptureTask) (Version: 1.7.1.9 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.1.1.21 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.1.0.8 - Canon Inc.)
CD Recovery Toolbox Free 1.1 (HKLM-x32\...\CD Recovery Toolbox Free_is1) (Version:  - Recovery Toolbox, Inc.)
Combined Community Codec Pack 2011-11-11 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2011.11.11.0 - CCCP Project)
CopyTrans Control Center deinstallieren (HKCU\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
Criminal Minds (HKLM-x32\...\Criminal Minds) (Version: 1.0 - Legacy Interactive)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deutsche Post E-Porto (HKLM\...\{AFEF38CC-13B4-45E9-AD68-1A842627B203}) (Version: 2.3.0 - Deutsche Post AG)
Deutsche Post E-Porto (HKLM-x32\...\{98595F74-7670-4CC6-810F-57AFA47222B0}) (Version: 2.3.0 - Deutsche Post AG)
Die Siedler II - Die nächste Generation (HKLM-x32\...\S2TNG) (Version:  - )
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.677.20 - Electronic Arts Inc.)
Die Sims™ 4 Erstelle einen Sim-Demo (HKLM-x32\...\{6908ED99-F02B-4E99-A202-3FAC99C510ED}) (Version: 1.0.237.100 - Electronic Arts Inc.)
DivX-Setup (HKLM-x32\...\DivX Setup.divx.com) (Version: 2.5.0.11 - DivX, LLC)
DKW Manager (HKLM-x32\...\{D36E76E0-3030-494D-8FFA-C128416BFA9D} DKW Manager_is1) (Version: v1.4.0.1 - Stentec Software)
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
eMule (HKLM-x32\...\eMule) (Version:  - )
Enigma (HKLM-x32\...\Enigma) (Version: 1.01 - Enigma Devel)
EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
Exif-Viewer 2.50  (HKLM-x32\...\Exif-Viewer) (Version: 2.50 - Ralf Bibinger)
Eye-Fi Center 3.4 (HKLM-x32\...\{18B00AC5-C082-471E-88B0-F02FE5A2541A}) (Version: 3.4.26 - Eye-Fi, Inc)
Fable - The Lost Chapters (HKLM-x32\...\Steam App 204030) (Version:  - )
Fable III (HKLM-x32\...\Steam App 105400) (Version:  - )
Facemoods Toolbar (HKLM-x32\...\facemoods) (Version:  - ) <==== ATTENTION
Fallout New Vegas (HKLM-x32\...\Fallout New Vegas_is1) (Version:  - )
Fences (Version: 1.0 - Stardock Corporation) Hidden
FileZilla Client 3.8.1 (HKLM-x32\...\FileZilla Client) (Version: 3.8.1 - Tim Kosse)
FINAL FANTASY VII (HKLM-x32\...\{141B8BA9-BFFD-4635-AF64-078E31010EC3}_is1) (Version: 1.0 - Square Enix)
Fitbit Connect (HKLM-x32\...\{5BD4A02D-B528-4916-A846-176B31A5D84F}) (Version: 1.0.3.5511 - Fitbit Inc.)
foobar2000 v1.1.10 (HKLM-x32\...\foobar2000) (Version: 1.1.10 - Peter Pawlowski)
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Free Audio Converter version 2.3.4.920 (HKLM-x32\...\Free Audio Converter_is1) (Version:  - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.42.716 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.42.716 - DVDVideoSoft Ltd.)
Garmin BaseCamp (HKLM-x32\...\{81EF7DBD-909A-455B-8B32-24B8CDC75039}) (Version: 4.3.3 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
gMapMaker (HKLM-x32\...\{097AAD07-F201-4258-8AB4-EBD95A626ACB}) (Version: 0.7 - Damien Debin)
Google SketchUp 8 (HKLM-x32\...\{4BA6784F-3B10-473A-B9F5-33A36AC354D5}) (Version: 3.0.14358 - Google, Inc.)
Gothic 2 Gold (HKLM-x32\...\{40FE74B5-71A1-4393-A0AB-21D6E1DA5A66}) (Version: 1.0.0 - JoWood)
Gothic 3 (HKLM-x32\...\{359ADF3A-F727-40F1-9D8A-6699EE355287}) (Version: 1.0.0 - JoWood)
Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version:  - )
Heroes of Might and Magic V - Tribes of the East (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version:  - )
Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version:  - )
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HS Nettoeinkommen Pro (HKLM-x32\...\HS Nettoeinkommen Pro) (Version:  - )
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.13.0.003 - HTC Corporation)
HTC Sync Manager (HKLM-x32\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.24.5 - HTC)
I-Doser Free (HKLM-x32\...\I-Doser) (Version: 5.0 - I-Doser.com)
Img2Ozf Version 3 (HKLM-x32\...\Img2Ozf_is1) (Version:  - )
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.6.0 - LIGHTNING UK!)
IP Camera (HKLM-x32\...\IP Camera) (Version:  - )
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
IsoBuster 3.2 (HKLM-x32\...\IsoBuster_is1) (Version: 3.2 - Smart Projects)
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Kindle PC Converter (HKLM-x32\...\KindleConverter) (Version:  - hxxp://www.ebook-converter.com)
LAME v3.98.3 for Audacity (HKLM-x32\...\LAME for Audacity_is1) (Version:  - )
LastPass (Nur deinstallieren) (HKLM-x32\...\LastPass) (Version:  - LastPass)
LG Bluetooth Drivers (HKLM-x32\...\{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}) (Version: 1.1 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{461B11E8-BF34-4ACB-962A-1CBE905BD9EB}) (Version: 2.2 - LG Electronics)
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version:  - )
Map Merge utility (HKLM-x32\...\Map Merge Utility for OziExplorer_is1) (Version:  - )
Mediencenter 3.9.1055.64 (HKCU\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4641.1003 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mobile Master Copy Station (x32 Version: 8.9.4 - Jumping Bytes) Hidden
Mobile Master Copy Station 8.9.4 (HKLM-x32\...\Mobile Master Copy Station) (Version: 8.9.4 - Jumping Bytes)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MPEG2 Video Encoder (HKLM-x32\...\{A2BCDAC1-B5F8-4E4A-9B1E-9FB70B2DE409}) (Version: 1.00.000 - )
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB927978) (HKLM-x32\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
MyHeritage Family Tree Builder (HKLM-x32\...\Family Tree Builder) (Version: 4.0.0.916 - MyHeritage.com)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero MediaHome 4 (x32 Version: 4.5.9.2 - Nero AG) Hidden
Nero MediaHome 4 Essentials (HKLM-x32\...\{4042d58a-13f6-4842-ab98-c69abe7fe1cf}) (Version:  - Nero AG)
Nero MediaHome 4 Help (x32 Version: 4.5.5.0 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
NetDrive (HKLM-x32\...\NetDrive) (Version: 1.3.4.0 - Bdrive Inc.)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
NetWorx 5.2.8 (HKLM\...\NetWorx_is1) (Version:  - Softperfect Research)
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.180.94 - Nokia)
Nokia PC Suite (x32 Version: 7.1.180.94 - Nokia) Hidden
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)
Nokia Suite (x32 Version: 3.8.48.0 - Nokia) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.8 - Notepad++ Team)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Controller-Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 301.42 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.16.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.16.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.145.1024 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0213 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.8.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.4.0 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Opera Stable 17.0.1241.53 (HKLM-x32\...\Opera 17.0.1241.53) (Version: 17.0.1241.53 - Opera Software ASA)
Optus Mini WiFi Modem (HKLM-x32\...\Optus Mini WiFi Modem) (Version: TOOL-ConnLaucher_WIN1.01.00.74 - Huawei Technologies Co.,Ltd)
Origin (HKLM-x32\...\Origin) (Version: 9.4.20.386 - Electronic Arts, Inc.)
OSCAR Editor (HKLM-x32\...\InstallShield_{21FFDD40-F6B9-4609-B1C9-514E0A342BFA}) (Version: 4.20.0000 - Ihr Firmenname)
OSCAR Editor (x32 Version: 4.20.0000 - Ihr Firmenname) Hidden
OziExplorer 3.95 (HKLM-x32\...\OziExplorer 3.95_is1) (Version:  - )
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
ParetoLogic PC Health Advisor (HKLM-x32\...\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}) (Version: 3.1.0.0 - ParetoLogic, Inc.)
PC Camera-UA0072 (HKLM-x32\...\{ECD03DA7-5952-406A-8156-5F0C93618D1F}) (Version: 5.18.1209.109 - Sonix)
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Portal 2 Publishing Tool (HKLM-x32\...\Steam App 644) (Version:  - )
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6438 - Realtek Semiconductor Corp.)
RGSS-RTP Standard (HKLM-x32\...\{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}) (Version: 1.0.0 - Enterbrain)
Risen 2 - Dark Waters (HKLM-x32\...\Steam App 40390) (Version:  - )
RPGXP (HKLM-x32\...\{9B34CAC6-738F-4A20-B428-A115C3E3474C}) (Version: 1.0.0 - Enterbrain)
Sacred (HKLM-x32\...\Sacred_is1) (Version:  - Ascaron Entertainment GmbH)
Sacred 2 - Elite (HKLM-x32\...\{2BB047B7-E613-4686-BE0C-E63BB26BE121}) (Version: 1.00.0000 -  )
Sacred 2 (HKLM-x32\...\{1023383E-D9F6-478C-A965-23A4657B3C9A}) (Version: 2.0.2.0 - Ascaron Entertainment)
Sacred Underworld (HKLM-x32\...\Sacred Underworld_is1) (Version:  - Ascaron Entertainment GmbH)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.34.0 - SAMSUNG Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Six Updater (HKLM-x32\...\{2D8CED57-CCDB-4D86-9087-3BBCAE8F8F22}) (Version: 2.09.7016 - Six Projects)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Smart File Advisor 1.1.3 (HKLM-x32\...\Smart File Advisor_is1) (Version: 1.1.3 - Filefacts.net)
Software Informer 1.2 (HKLM\...\Software Informer_is1) (Version:  - Informer Technologies, Inc.)
Sophos Anti-Rootkit 1.5.0 (HKLM-x32\...\Sophos-AntiRootkit) (Version: 1.5.0 - Sophos Plc)
Spellforce 2 Gold (HKLM-x32\...\{746F49C9-3789-4F8E-AF3A-3A4B42ACFAF8}) (Version: 1.00.0000 - JoWooD Productions Software AG)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Sweet Home 3D version 3.7 (x32 Version:  - eTeks) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab Detection (HKLM-x32\...\{9E6B0490-82A4-42C2-8F34-2026973E8658}) (Version: 2.0.0.0 - Husdawg, LLC)
Tabellenbuch Metall digital 6.0 (HKLM-x32\...\{CB87D276-2F4A-453A-A2D8-D597927C59A0}) (Version: 6.00.0000 - Verlag Europa Lehrmittel)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.6 - TeamSpeak Systems GmbH)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.16642 - TeamViewer)
TFA_Nexus (HKLM-x32\...\TFA_Nexus) (Version: 1.3 - HMD GmbH)
Thief - Deadly Shadows (HKLM-x32\...\{FC123EEA-330A-4685-911C-95B8F5E9DE68}) (Version: 1.0 - )
Thief - Deadly Shadows Collective Texture Pack by John P., ver. 1.0.3 (HKLM-x32\...\Collective Thief: DS Texture Pack by John P. 1.03) (Version:  - John P.)
TL-WN822N/TL-WN821N Driver (HKLM-x32\...\{62FE0726-9652-4CD2-9F09-C769D8699C21}) (Version: 1.0.0 - TP-LINK)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)
T-Mobile Internet Manager (HKLM-x32\...\T-Mobile Internet Manager) (Version: 11.301.05.02.121 - Huawei Technologies Co.,Ltd)
TP-LINK Wireless Client Utility (HKLM-x32\...\{1E03C8BE-0848-430F-BECA-7D7709401626}) (Version: 7.0 - TP-LINK)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.0.0 - TP-LINK)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4500.49 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
UFRaw 0.18 (HKLM-x32\...\UFRaw_is1) (Version:  - Udi Fuchs)
UltraStar Deluxe (HKLM-x32\...\UltraStar Deluxe) (Version: 1.1 - USDX Team)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
VobSub v2.23 (Remove Only) (HKLM-x32\...\VobSub) (Version:  - )
WBFS Manager 4.0 (HKLM\...\{D34C07CA-DCF0-4A5C-A4DD-55522B17F4F2}) (Version: 4.0 - WBFS)
webcam 7 (HKLM-x32\...\webcam 7) (Version: 0.9.9.43 - Moonware Studios)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia Modem  (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Windows-Treiberpaket - Nokia Modem  (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinGPS 5 Lite (HKLM-x32\...\{893CAB77-A98D-46AE-8516-291660A501E5} WinGPS 5 Lite_is1) (Version: v5.0.1.4 - Stentec Software)
Winmail Opener 1.6 (HKLM-x32\...\Winmail Opener) (Version: 1.6 - Eolsoft)
WISO Steuer-Sparbuch 2011 (HKLM-x32\...\{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}) (Version: 18.13.7477 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2012 (HKCU\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.10.7954 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{488655CC-844E-4E65-9889-1AA64C939BA0}) (Version: 21.00.8480 - Buhl Data Service GmbH)
XMedia Recode Version 3.1.7.4 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.4 - XMedia Recode)
Xvid 1.1.3 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.1 - Xvid team (Koepi))
XviD MPEG4 Video Codec (remove only) (HKLM-x32\...\XviD MPEG4 Video Codec) (Version:  - )
Z-Cron (HKLM-x32\...\{FD57FF4D-7225-4DAC-B15D-9BAE3E8A0E2B}) (Version: 4.9.0.32 - IMU Andreas Baumann)
ZTE Handset USB Driver (HKLM\...\{D2D77DC2-8299-11D1-8949-444553540000}_is1) (Version: 5.2066.1.A11B02 - ZTE Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1505511330-1522540267-1352390042-1008_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

14-09-2014 07:45:10 PC Health Advisor Backup

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2013-12-26 08:40 - 00002667 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 registeraudials.com
127.0.0.1 registeraudials.com
127.0.0.1 audials.com
127.0.0.1 188.40.53.196
127.0.0.1 lists.rs-audials.com
127.0.0.1 securestore.audials.com
127.0.0.1 secure.element5.com
127.0.0.1 shop.audials.com
127.0.0.1 userstats.audials.com
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 192.150.18.108
127.0.0.1 activate.adobe.com:443
127.0.0.1 3dns.adobe.com
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com

There are 31 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0A61F76A-B634-4F42-AB3E-20FA0CBB2667} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {0F45CFA2-ADEF-46C0-A3C0-AE14B342E209} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-03-21] ()
Task: {2D94F69A-8A70-4F86-8FD9-A1A6D4EE136F} - System32\Tasks\{6CF8998B-7E32-4B2D-A77B-1D4602880317} => C:\Users\TheDomay\Videos\installer_scp-087.exe
Task: {3054A778-FEFF-4451-9605-77D712A88A84} - System32\Tasks\PC Health Advisor => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2014-04-29] (ParetoLogic, Inc.)
Task: {32091408-EF07-48B0-95B2-92CDC53AA154} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {4AFD08CE-D161-43F6-B704-94F6F4BA9E33} - System32\Tasks\{1F6E3C0A-F3D1-4905-A441-83EBAED1ECBA} => C:\Users\TheDomay\Desktop\SCP - Containment Breach v0.6.4\SCP - Containment Breach v0.6.4.exe
Task: {61BA8FCE-479E-4F26-AA00-34CAB00B8F33} - System32\Tasks\{E528D7C1-FF03-4B9D-8042-CFED9BD49BED} => C:\Users\TheDomay\Videos\installer_scp-087.exe
Task: {888E8DD4-10C3-49F2-A5FE-2404DA908B96} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-08-01] (Microsoft Corporation)
Task: {89B30E7B-3C7E-4C0B-B78D-4E831AD13D06} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-30] (ParetoLogic Inc.)
Task: {9CBDD267-22AE-47EA-9E39-5AD281B5F508} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000Core => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {AA04F0F7-6087-44A4-ADF6-82303F977C9E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000UA => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - System32\Tasks\Microsoft\Windows\Application Experience\AitAgent => aitagent.exe
Task: {B117078F-44AC-4E01-B91F-15FC79572E84} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns
Task: {B41676A7-8593-4138-94A6-259877CE444F} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {B563E16F-928E-4639-BCCF-0BDC177F183D} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {BAD3072C-19BC-46CE-851D-C373306ED022} - System32\Tasks\AdobeAAMUpdater-1.0-TheDomay-PC-Sabine => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-30] (Adobe Systems Incorporated)
Task: {D3F299F2-8A28-429F-8ABD-5024600A4FDD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-08-29] (Microsoft Corporation)
Task: {D86570EF-3885-447B-BE6F-D62D20F16564} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {DD0B7596-1F3B-4E9D-884C-78988F74A874} - System32\Tasks\Microsoft Office 15 Sync Maintenance for TheDomay-PC-Sabine TheDomay-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-08-29] (Microsoft Corporation)
Task: {DE865F0D-8DF0-4175-93DA-75AEB25A7845} - System32\Tasks\PC Health Advisor Defrag => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2014-04-29] (ParetoLogic, Inc.)
Task: {E3163C33-301D-4730-A266-5518C5ED3967} - System32\Tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask => BthUdTask.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000Core.job => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000UA.job => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\ParetoLogic Registration3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll
Task: C:\Windows\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe
Task: C:\Windows\Tasks\PC Health Advisor Defrag.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
Task: C:\Windows\Tasks\PC Health Advisor.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe

==================== Loaded Modules (whitelisted) =============

2014-07-22 08:21 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2011-03-22 10:08 - 2011-03-22 10:08 - 00161280 _____ () C:\Program Files\NetDrive\libexpat.dll
2013-06-01 06:58 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2013-01-13 08:18 - 2005-04-22 14:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2014-07-16 10:24 - 2014-07-16 10:24 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-10-01 11:32 - 2013-10-01 11:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2014-05-01 21:29 - 2014-05-01 21:29 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2011-04-07 23:19 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-08-13 18:28 - 2007-05-10 13:18 - 00835584 _____ () C:\Windows\vsnpstd3.exe
2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-05-27 12:32 - 2014-05-27 12:32 - 00031080 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll
2014-08-06 13:41 - 2014-08-06 13:41 - 00607376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll
2014-05-27 12:33 - 2014-05-27 12:33 - 00059752 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll
2014-05-27 12:32 - 2014-05-27 12:32 - 00036216 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll
2014-05-27 12:33 - 2014-05-27 12:33 - 00080248 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\ninstallerhelper.dll
2014-05-27 12:34 - 2014-05-27 12:34 - 00129376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\zlib1.dll
2014-05-27 12:35 - 2014-05-27 12:35 - 00223592 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll
2011-10-16 17:48 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-08-15 07:13 - 2014-08-31 18:06 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-08-15 07:13 - 2014-08-31 18:05 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2014-02-04 19:25 - 2014-02-04 19:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-02-04 19:28 - 2014-02-04 19:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2014-07-22 08:22 - 2014-07-22 08:25 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-09-12 23:26 - 2014-09-12 23:26 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-19 17:06 - 2014-08-19 17:06 - 01020928 _____ () C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll
2014-06-01 11:08 - 2014-06-01 11:08 - 00035328 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00091648 _____ () C:\Program Files (x86)\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00892416 _____ () C:\Program Files (x86)\FileZilla FTP Client\libstdc++-6.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00699072 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2013-10-01 12:00 - 2013-10-01 12:00 - 00022336 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Sabine\Documents\Eingangsbest_tigung_-_Ihre_Bestellung_bei_der_Telekom_20140630-Y0109-67170.eml:OECustomProperty
AlternateDataStreams: C:\Users\Sabine\Documents\Finanzen_2013_6_xls.eml:OECustomProperty
AlternateDataStreams: C:\Users\TheDomay\AppData\Local\fjrQbyhG:yjocDaxFQ1eFV4fCAQrBav8wbgr
AlternateDataStreams: C:\Users\TheDomay\AppData\Local\Temp:1tdnn16vMTFZrFNwUbRXp1XLwpBFLu

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:53:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMON BrtSTMON: [2014/09/15 02:53:25.964]: [00002900]:    Don't Create FileMapping!!!!


System errors:
=============
Error: (09/13/2014 09:33:25 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Acronis Sync Agent Service" wurde nicht richtig gestartet.

Error: (09/13/2014 09:31:10 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (09/13/2014 09:31:10 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (09/13/2014 09:30:59 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (09/13/2014 09:29:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (09/13/2014 09:29:27 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (09/13/2014 09:29:06 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
SAVRKBootTasks
SBRE

Error: (09/13/2014 09:28:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Hi-Rez Studios Authenticate and Update Service erreicht.

Error: (09/13/2014 09:27:42 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\SysWow64\drivers\SSHDRV65.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (09/12/2014 05:12:57 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================
Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:59:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:59:25.999]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:57:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:57:25.986]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    Don't Create FileMapping!!!!

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    FrendlyName : Brother MFC-5890CN Printer

Error: (09/15/2014 02:55:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:55:25.974]: [00002900]:    Error : ExecMonitor()

Error: (09/15/2014 02:53:25 AM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: STMONBrtSTMON: [2014/09/15 02:53:25.964]: [00002900]:    Don't Create FileMapping!!!!


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X2 250 Processor
Percentage of memory in use: 44%
Total physical RAM: 8191.23 MB
Available physical RAM: 4577.61 MB
Total Pagefile: 16380.63 MB
Available Pagefile: 12998.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Dominik Systeme) (Fixed) (Total:465.76 GB) (Free:113.21 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DOMINIK daten) (Fixed) (Total:232.88 GB) (Free:223.35 GB) NTFS
Drive g: (Bine Sonstiges) (Fixed) (Total:465.76 GB) (Free:146.9 GB) NTFS
Drive h: (Bine Ebooks) (Fixed) (Total:236.02 GB) (Free:82.01 GB) NTFS
Drive i: (Bine Filme Keller ) (Fixed) (Total:229.74 GB) (Free:15.62 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: CFD7CFD7)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 39797851)
Partition 2: (Not Active) - (Size=232.9 GB) - (Type=OF Extended)

========================================================
Disk: 2 (Size: 465.8 GB) (Disk ID: 1AE81A16)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: 63E16945)
Partition 1: (Not Active) - (Size=236 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=229.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:04 on 15/09/2014 (Sabine)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Sabine (administrator) on THEDOMAY-PC on 15-09-2014 08:05:50
Running from C:\Users\Sabine\Desktop\Malware entfernen
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Bdrive Inc.) C:\Program Files\NetDrive\ndsvc.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(A.Baumann IMU-BerliNet) C:\Program Files (x86)\Z-Cron\z-cron.exe
() C:\Windows\vsnpstd3.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BRMFCWND.EXE [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [snpstd3] => C:\Windows\vsnpstd3.exe [835584 2007-05-10] ()
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Nero MediaHome 4] => C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe [5178664 2010-10-26] (Nero AG)
HKLM-x32\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [] => [X]
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [SkyDrive] => C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-08-07] (Microsoft Corporation)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-08-31] (Electronic Arts)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {43ace4cc-f527-11e3-9ba4-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {47cb2f6f-0dcb-11e2-b586-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {4dfd2b4f-2126-11e4-903a-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {542157f3-a43a-11e3-82df-f46d04d4169c} - F:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {c3e0fea7-1620-11e4-95ce-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {e13451bd-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\MountPoints2: {e13451cc-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\.lnk
ShortcutTarget: .lnk -> C:\Program Files (x86)\Z-Cron\z-cron.exe (A.Baumann IMU-BerliNet)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.de/ie
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE64.ols (OpenLimit SignCubes AG)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MHTBPos00 Class -> {0C37B053-FD68-456a-82E1-D788EE342E6F} ->  No File
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: CescrtHlpr Object -> {64182481-4F71-486b-A045-B233BD0DA8FC} -> C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll (facemoods.com BHO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Toolbar: HKLM-x32 - facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll (facemoods.com)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854
FF Homepage: hxxp://www.kadaza.de/
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*'))%20%7B%20return%20'PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\user.js
FF user.js: detected! => C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-1505511330-1522540267-1352390042-1008\FireFox\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fire IE - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\fireie@fireie.org [2014-06-18]
FF Extension: LastPass - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\support@lastpass.com [2014-08-20]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-02-05]
FF Extension: PAYBACK Toolbar - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\toolbar-ff@payback.de.xpi [2013-08-02]
FF Extension: Session Manager - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2012-11-01]
FF Extension: Adblock Plus - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-07]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-09-12]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-12]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011-06-20]
FF HKLM-x32\...\Firefox\Extensions: [{4F3D26C8-9907-48ff-BC74-B8C572D317BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [{4F0963A3-1658-4fde-9585-23A25CC288BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址過濾 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Sicherer Zahlungsverkehr - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-21]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM-x32\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files (x86)\OnlineHD.TV\onhd10.crx [2012-10-15]
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM-x32\...\Chrome\Extension: [ihflimipbcaljfnojhhknppphnnciiif] - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoods.crx [2010-11-24]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2369720 2014-08-01] (Microsoft Corporation)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [1436192 2014-05-19] (Fitbit, Inc.)
S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [8704 2012-07-12] (Hi-Rez Studios) [File not signed]
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-04-02] (Nero AG)
R2 ndsvc; C:\Program Files\NetDrive\ndsvc.exe [2789376 2013-02-25] (Bdrive Inc.) [File not signed]
R2 NeroMediaHomeService.4; C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe [517416 2010-10-26] (Nero AG)
R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [64512 2010-11-26] (Nalpeiron Ltd.) [File not signed]
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 w7Svc; C:\Program Files (x86)\webcam 7\wService.exe [5094200 2012-03-26] (Moonware Studios)
S3 WinHttpAutoProxySvc; winhttp.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [252928 2010-04-30] (Huawei Technologies Co., Ltd.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [140352 2014-08-21] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [792128 2014-08-21] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [18456 2011-07-07] (HandSet Incorporated)
S3 MEMSWEEP2; C:\Windows\system32\EAC3.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 ndfs; C:\Program Files\NetDrive\ndfs.sys [63712 2013-02-01] (Bdrive Inc.)
R1 networx; C:\Windows\System32\drivers\networx.sys [58360 2013-01-25] (NetFilterSDK.com)
S1 SAVRKBootTasks; C:\Windows\SysWOW64\SAVRKBootTasks.sys [18816 2009-06-18] (Sophos Plc) [File not signed]
S1 SSHDRV65; C:\Windows\SysWOW64\drivers\SSHDRV65.sys [120320 2011-05-14] () [File not signed]
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-03-22] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-03-22] (Acronis International GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-06-23] (TuneUp Software)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2010-10-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2010-10-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2010-10-21] (LG Electronics Inc.)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-03-22] (Acronis International GmbH)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [129432 2011-09-13] (ZTE Incorporated)
S3 Gun; \??\C:\Game\SoftnyxGame\GunBoundIS\Gun64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
S3 sj; \??\C:\AeriaGames\EdenEternal\sjcs64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-15 08:05 - 2014-09-15 08:05 - 00000000 ____D () C:\FRST
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:00 - 2014-09-15 08:05 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-15 07:49 - 2014-09-15 07:53 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-14 23:35 - 2014-09-14 23:40 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 23:28 - 2002-01-02 22:01 - 00000285 _____ () C:\Users\TheDomay\Desktop\rules_regeln.txt
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:26 - 2014-09-14 10:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:02 - 2014-09-12 23:03 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-07 20:59 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-07 20:59 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-09-07 20:59 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-07 20:59 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-09-07 20:58 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-09-07 20:58 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-09-07 20:57 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-07 20:57 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-07 20:57 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-07 20:57 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-07 20:57 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-07 20:57 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-07 20:57 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-07 20:57 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-07 20:57 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-07 20:57 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-07 20:57 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-07 20:57 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-07 20:57 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-07 20:57 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-07 20:57 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-07 20:57 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-07 20:57 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-07 20:57 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-07 20:57 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-07 20:57 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-09-07 20:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-09-07 20:56 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-07 20:56 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-09-07 20:56 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-07 20:56 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-07 20:56 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-07 20:56 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-07 20:56 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-09-07 20:56 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-09-07 20:54 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-09-07 20:54 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-09-05 05:42 - 2014-09-12 22:55 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-03 06:15 - 2014-09-13 09:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-08-31 16:44 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-08-31 16:44 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-08-31 16:43 - 2014-08-31 16:44 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:39 - 2014-08-31 17:07 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-30 21:14 - 2014-07-22 09:45 - 00000000 ____D () C:\Users\Sabine\Desktop\TuneUp Utilities 2014 v14.0.1000.340
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:12 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 19:09 - 2014-08-21 19:22 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:09 - 2014-08-21 19:22 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:09 - 2014-04-10 17:25 - 00243808 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-08-21 18:29 - 2014-08-21 18:33 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:48 - 2014-08-21 11:49 - 00000000 ____D () C:\backup
2014-08-20 16:11 - 2014-08-20 16:12 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:50 - 2014-08-25 10:23 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieUserList
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieSiteList
2014-08-19 09:42 - 2014-08-19 09:42 - 00004741 _____ () C:\Users\Sabine\Desktop\Mods - Verknüpfung.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000577 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2014-08-18 09:00 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-08-18 09:00 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-08-17 16:29 - 2014-08-17 16:29 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-16 14:39 - 2014-08-16 14:39 - 00001798 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-16 14:39 - 2014-08-16 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-16 14:38 - 2014-08-16 14:39 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-16 14:38 - 2014-08-16 14:39 - 00000000 ____D () C:\Program Files\iTunes
2014-08-16 14:38 - 2014-08-16 14:39 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-16 14:38 - 2014-08-16 14:38 - 00000000 ____D () C:\Program Files\iPod
2014-08-16 14:32 - 2014-08-16 14:32 - 00001860 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-08-16 14:31 - 2014-08-16 14:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-15 08:05 - 2014-09-15 08:05 - 00000000 ____D () C:\FRST
2014-09-15 08:05 - 2014-09-15 08:00 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:04 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine
2014-09-15 07:53 - 2014-09-15 07:49 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 07:50 - 2012-10-09 15:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-15 07:42 - 2011-05-13 18:01 - 01811159 _____ () C:\Windows\WindowsUpdate.log
2014-09-15 07:37 - 2014-03-05 09:55 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-15 03:22 - 2014-05-27 15:34 - 00005152 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for TheDomay-PC-Sabine TheDomay-PC
2014-09-14 23:40 - 2014-09-14 23:35 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 20:27 - 2011-05-14 17:39 - 00000000 ____D () C:\Users\TheDomay\Documents\Anki
2014-09-14 18:00 - 2014-08-11 07:45 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-09-14 10:50 - 2014-09-12 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-14 10:50 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Macromedia
2014-09-14 09:46 - 2014-08-11 07:45 - 00000384 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-09-14 09:45 - 2014-08-11 09:00 - 00000530 _____ () C:\0.bak
2014-09-13 09:36 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-13 09:36 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-13 09:32 - 2014-09-03 06:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-13 09:32 - 2014-08-15 07:13 - 00000000 ____D () C:\ProgramData\Origin
2014-09-13 09:32 - 2012-04-24 22:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-13 09:31 - 2014-05-27 15:28 - 00000000 ___RD () C:\Users\Sabine\OneDrive
2014-09-13 09:30 - 2014-03-15 01:58 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\HTC MediaHub
2014-09-13 09:29 - 2014-08-15 07:12 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-13 09:28 - 2013-09-12 15:59 - 00035634 _____ () C:\ndsvc.log
2014-09-13 09:27 - 2014-05-08 17:58 - 01233776 _____ () C:\Windows\PFRO.log
2014-09-13 09:27 - 2014-04-21 01:00 - 00013977 _____ () C:\Windows\setupact.log
2014-09-13 09:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:25 - 2011-05-13 22:02 - 00132696 _____ () C:\Users\TheDomay\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000982 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\UpdatusUser\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\TheDomay\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\Administrator\Desktop\Anki.lnk
2014-09-12 23:03 - 2014-09-12 23:02 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-12 22:55 - 2014-09-05 05:42 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-12 06:41 - 2014-08-11 07:45 - 00000402 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-09-12 02:06 - 2014-08-11 07:45 - 00000444 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-09-11 14:56 - 2012-10-27 17:35 - 00000000 ____D () C:\Users\Sabine\Desktop\Studium
2014-09-11 14:26 - 2013-02-07 12:02 - 00674304 ___SH () C:\Users\Sabine\Desktop\Thumbs.db
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-10 04:51 - 2011-05-14 12:24 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\TuneUp Software
2014-09-10 02:50 - 2012-10-09 15:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 02:50 - 2012-04-03 12:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 02:50 - 2011-06-13 14:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-09 12:01 - 2011-05-14 12:21 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-09-09 08:51 - 2009-07-14 19:58 - 00702954 _____ () C:\Windows\system32\perfh007.dat
2014-09-09 08:51 - 2009-07-14 19:58 - 00150612 _____ () C:\Windows\system32\perfc007.dat
2014-09-09 08:51 - 2009-07-14 07:13 - 01629370 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-08 21:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-08 06:39 - 2014-07-26 08:23 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-09-08 06:39 - 2011-05-13 18:36 - 00001440 _____ () C:\Users\TheDomay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-08 06:38 - 2011-11-15 17:48 - 00000000 ____D () C:\Users\TheDomay\.android
2014-09-08 06:35 - 2009-07-14 06:45 - 05179160 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 06:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-07 21:14 - 2014-07-25 15:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-07 21:05 - 2012-01-16 12:58 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-07 10:22 - 2013-04-25 08:44 - 00041494 _____ () C:\Users\Administrator\Downloads\Feiertage_DE.ics
2014-09-05 14:59 - 2014-08-15 07:24 - 00000000 ____D () C:\Users\Sabine\Documents\Electronic Arts
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-05 05:42 - 2011-11-02 14:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-05 05:10 - 2014-08-15 07:14 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-09-01 07:34 - 2013-11-18 13:00 - 00000000 ____D () C:\Users\Sabine\Bilder für Bine
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 18:08 - 2013-06-01 06:59 - 00000000 ____D () C:\Users\Sabine\AppData\Local\HTC MediaHub
2014-08-31 17:07 - 2014-08-31 16:39 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-31 17:07 - 2014-07-23 13:23 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Mobile Master
2014-08-31 17:07 - 2013-02-22 18:15 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Downloaded Installations
2014-08-31 17:07 - 2012-02-26 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftnyxGame
2014-08-31 17:07 - 2011-11-02 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foto und Video
2014-08-31 17:07 - 2011-06-21 16:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-31 17:07 - 2011-06-06 00:16 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-08-31 16:43 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:44 - 2012-10-01 11:19 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\TuneUp Software
2014-08-31 06:25 - 2014-07-18 12:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-30 09:03 - 2013-11-27 07:14 - 00000000 ____D () C:\Users\Sabine\Documents\Arbeitszeiten-Netto
2014-08-26 21:14 - 2014-08-15 07:24 - 00001502 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:23 - 2014-08-20 06:50 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-25 06:53 - 2011-05-13 18:59 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 17:13 - 2014-02-02 11:52 - 00000000 ____D () C:\Users\Sabine\Documents\Dominik Studium
2014-08-24 12:40 - 2013-05-08 12:59 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-08-23 04:07 - 2014-09-07 20:56 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-09-07 20:56 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-09-07 20:56 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 18:33 - 2014-08-21 18:29 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:49 - 2014-08-21 11:48 - 00000000 ____D () C:\backup
2014-08-21 09:16 - 2012-12-13 08:05 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Notepad++
2014-08-21 09:16 - 2012-12-13 08:03 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-08-20 16:12 - 2014-08-20 16:11 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:24 - 2012-10-03 12:56 - 00000000 ____D () C:\Users\Sabine\Documents\Mein Steuer-Sparbuch Heute
2014-08-20 06:24 - 2011-08-22 03:45 - 00000000 ____D () C:\Fraps
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieUserList
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieSiteList
2014-08-19 09:42 - 2014-08-19 09:42 - 00004741 _____ () C:\Users\Sabine\Desktop\Mods - Verknüpfung.lnk
2014-08-18 18:01 - 2012-12-09 07:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Apple Computer
2014-08-18 09:00 - 2014-08-18 09:00 - 00000577 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2014-08-17 16:29 - 2014-08-17 16:29 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-17 08:32 - 2014-07-25 09:53 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\WindSolutions
2014-08-17 08:29 - 2014-07-25 09:53 - 00000000 ____D () C:\ProgramData\WindSolutions
2014-08-16 17:55 - 2012-10-03 12:40 - 00000817 _____ () C:\Windows\wiso.ini
2014-08-16 14:48 - 2013-01-04 14:15 - 00000000 ___RD () C:\Users\Sabine\Mediencenter
2014-08-16 14:47 - 2014-08-15 07:14 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Origin
2014-08-16 14:44 - 2013-03-13 12:22 - 00000000 ____D () C:\Program Files (x86)\OXXOGames
2014-08-16 14:39 - 2014-08-16 14:39 - 00001798 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-16 14:39 - 2014-08-16 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-16 14:39 - 2014-08-16 14:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-16 14:39 - 2014-08-16 14:38 - 00000000 ____D () C:\Program Files\iTunes
2014-08-16 14:39 - 2014-08-16 14:38 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-16 14:38 - 2014-08-16 14:38 - 00000000 ____D () C:\Program Files\iPod
2014-08-16 14:32 - 2014-08-16 14:32 - 00001860 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-08-16 14:32 - 2014-08-16 14:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-08-16 14:32 - 2011-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\QuickTime

Files to move or delete:
====================
C:\Users\Sabine\jre-7u7-windows-x64.exe


Some content of TEMP:
====================
C:\Users\TheDomay\AppData\Local\Temp\drm_dialogs.dll
C:\Users\TheDomay\AppData\Local\Temp\drm_dyndata_7300015.dll
C:\Users\TheDomay\AppData\Local\Temp\NEventMessages.dll
C:\Users\TheDomay\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 00:02

==================== End Of Log ============================
         

--- --- ---

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-15 08:19:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a WDC_WD50 rev.06.0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Sabine\AppData\Local\Temp\fglirkob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                                          fffff80003db2000 16 bytes [00, 00, 00, F6, 41, 38, 08, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 545                                                                                                                                                                          fffff80003db2011 2 bytes [83, C1]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe[2008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                               00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                         0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                        00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                           0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                          00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Browny02\BrYNSvc.exe[4784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                   0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Browny02\BrYNSvc.exe[4784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[5444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                 0000000075571465 2 bytes [57, 75]
.text     C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[5444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe[5600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                      0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe[5600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                     00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\kernel32.dll!CreateFileW                                                                                                                                                 0000000076343f1c 2 bytes JMP 0000000165c89490
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\kernel32.dll!CreateFileW + 3                                                                                                                                             0000000076343f1f 2 bytes [94, EF]
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!SetWindowPos                                                                                                                                                  0000000075478e4e 5 bytes JMP 0000000165c88c40
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                                                                                    0000000075480dfb 5 bytes JMP 0000000165c88bd0
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!SetFocus                                                                                                                                                      0000000075482175 5 bytes JMP 0000000165c88c20
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!SetActiveWindow                                                                                                                                               0000000075483208 5 bytes JMP 0000000165c88c90
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!BringWindowToTop                                                                                                                                              0000000075487b3b 5 bytes JMP 0000000165c88b30
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!SetForegroundWindow                                                                                                                                           000000007549f170 5 bytes JMP 0000000165c88b00
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!SwitchToThisWindow                                                                                                                                            00000000754b90fc 5 bytes JMP 0000000165c88b60
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\USER32.dll!ShowWindowAsync                                                                                                                                               00000000754d7d97 5 bytes JMP 0000000165c88b80
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\ole32.dll!DoDragDrop                                                                                                                                                     0000000076d8a827 5 bytes JMP 0000000165c88ae0
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                      0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Origin\Origin.exe[5816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                     00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe[6532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                0000000075571465 2 bytes [57, 75]
.text     C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe[6532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                               00000000755714bb 2 bytes [57, 75]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                  00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                       000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                       000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                               000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                               0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                              0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                 0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                 0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                     0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                    0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                   0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                           0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                       0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                       0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                            0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                   00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                 00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                  000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                 0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                         0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                         0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                 0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                     000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                     00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                    0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                    0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                        0000000077713b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                        0000000077713d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                 0000000077714190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                           0000000077761380 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                         0000000077761500 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                               0000000077761530 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                             0000000077761650 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                 0000000077761700 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                 0000000077761d30 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                               0000000077761f80 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                               00000000777627e0 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                             00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                             000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                          00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                            00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                       00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                       00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                 0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                   0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                 0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe[6936] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                      0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                         00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                       0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                              000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                              000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                      000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                      0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                     0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                        0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                        0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                            0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                           0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                          0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                  0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                              0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                              0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                   0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                          00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                        00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                         000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                        0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                        0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                            000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                            00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                           0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                           0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                               0000000077713b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                               0000000077713d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                        0000000077714190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                  0000000077761380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                0000000077761500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                      0000000077761530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                    0000000077761650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                        0000000077761700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                        0000000077761d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                      0000000077761f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                      00000000777627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                    00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                    000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                 00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                   00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                              00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                              00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                        0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                          0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                        0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                             0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                 000000007790f9e0 5 bytes JMP 0000000159def270
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                               000000007790fa28 5 bytes JMP 0000000159def8d2
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                     000000007790fa40 5 bytes JMP 0000000159dee00d
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                              000000007790fa90 5 bytes JMP 0000000159dedb69
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                         000000007790faa8 5 bytes JMP 0000000159dede5a
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                             000000007790fb40 5 bytes JMP 0000000159defb12
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                    000000007790fc38 5 bytes JMP 0000000159dfaccc
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                          000000007790fd4c 5 bytes JMP 0000000159ded9b1
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                              000000007790fd64 5 bytes JMP 0000000159dfa2ee
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                    000000007790fd98 5 bytes JMP 0000000159dfa5e9
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                       000000007790fe44 5 bytes JMP 0000000159deee45
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                   000000007790fe5c 5 bytes JMP 0000000159dfa417
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                            00000000779100b4 5 bytes JMP 0000000159dfa133
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                           00000000779101c4 5 bytes JMP 0000000159dee1b5
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtCreateKeyTransacted                                                                   0000000077910754 5 bytes JMP 0000000159defbb4
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                            00000000779109e4 5 bytes JMP 0000000159dfa32b
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                             00000000779109fc 5 bytes JMP 0000000159ded785
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                        0000000077910a44 5 bytes JMP 0000000159dee36b
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                              0000000077910b80 5 bytes JMP 0000000159ded89b
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                       0000000077910f70 5 bytes JMP 0000000159dee7f8
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                              0000000077910f88 5 bytes JMP 0000000159dee994
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                             0000000077911018 5 bytes JMP 0000000159def95f
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransacted                                                                     0000000077911030 5 bytes JMP 0000000159defa82
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransactedEx                                                                   0000000077911048 5 bytes JMP 0000000159def9ef
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                               000000007791133c 5 bytes JMP 0000000159dfa500
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                 000000007791147c 5 bytes JMP 0000000159dee66b
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                   0000000077911528 5 bytes JMP 0000000159deeb58
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                             0000000077911718 5 bytes JMP 0000000159dee4e3
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                     0000000077911a58 5 bytes JMP 0000000159dedd12
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                     0000000077911b9c 5 bytes JMP 0000000159deecda
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                       000000007634103d 5 bytes JMP 0000000159dd35da
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                       0000000076341072 5 bytes JMP 0000000159dd3a3e
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                 000000007636c9b5 5 bytes JMP 0000000159dd36f4
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\kernel32.dll!WinExec                                                                              00000000763c2ff1 5 bytes JMP 0000000159dd3938
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                 00000000773d2642 5 bytes JMP 0000000159dd3c4b
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\USER32.dll!RegisterClipboardFormatW                                                               0000000075479ebd 5 bytes JMP 00000001564761bd
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\USER32.dll!RegisterClipboardFormatA                                                               0000000075480afa 5 bytes JMP 000000015647ac1d
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\USER32.dll!BeginPaint                                                                             0000000075481361 3 bytes JMP 0000000156489197
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\USER32.dll!BeginPaint + 4                                                                         0000000075481365 1 byte [E1]
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\USER32.dll!ValidateRect                                                                           0000000075487849 5 bytes JMP 00000001565e72cf
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\SHELL32.dll!SHParseDisplayName                                                                    0000000075737edb 5 bytes JMP 00000001565406a2
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!OleLoadFromStream                                                                       0000000076c86143 5 bytes JMP 0000000156bbec5c
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                0000000076c8ea09 7 bytes JMP 0000000159e0e7f9
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!OleRun                                                                                  0000000076c907de 5 bytes JMP 0000000159e0e338
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                   0000000076c921e1 5 bytes JMP 0000000159e11c0c
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                         0000000076c9eba1 6 bytes JMP 0000000159e0e2af
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                           0000000076c9efd7 5 bytes JMP 0000000159e0e267
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                        0000000076cb54ad 5 bytes JMP 0000000159e10282
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                          0000000076cc09ad 5 bytes JMP 0000000159e0e207
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                          0000000076cc86d3 5 bytes JMP 0000000159e10c96
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                        0000000076cc9d0b 5 bytes JMP 0000000159e119b3
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                      0000000076cc9d4e 5 bytes JMP 0000000159e0f891
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                               0000000076cebb09 7 bytes JMP 0000000159e0e380
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                     0000000076d0eacf 5 bytes JMP 0000000159e0ff46
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                   0000000076d4340b 5 bytes JMP 0000000159e10d96
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                     0000000076d8cfd9 5 bytes JMP 0000000159e0e2f0
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString                                                                        00000000768c3e59 5 bytes JMP 00000001564b3c00
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!VariantClear                                                                         00000000768c3eae 5 bytes JMP 00000001564c9071
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen                                                                00000000768c4731 5 bytes JMP 00000001564d2760
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType                                                                    00000000768c5dee 5 bytes JMP 000000015654abb1
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!RegisterActiveObject                                                                 00000000768f279e 1 byte JMP 0000000159e108a2
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!RegisterActiveObject + 2                                                             00000000768f27a0 3 bytes {JMP RAX}
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!RevokeActiveObject                                                                   00000000768f3294 5 bytes JMP 0000000159e0e1bf
.text     C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE[5040] C:\Windows\syswow64\OLEAUT32.dll!GetActiveObject                                                                      0000000076908f40 5 bytes JMP 0000000159e10a36
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                 00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                               0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                      000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                      000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                              000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                              0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                             0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                    0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                   0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                  0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                          0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                      0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                      0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                           0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                  00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                 000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                        0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                        0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                    000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                    00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                   0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                   0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                       0000000077713b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                       0000000077713d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                0000000077714190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                          0000000077761380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                        0000000077761500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                              0000000077761530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                            0000000077761650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                0000000077761700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                0000000077761d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                              0000000077761f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                              00000000777627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                            00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                            000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                         00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                           00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                      00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                      00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                  0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                     0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                                      00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                                    0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                           000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                           000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                   000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                                   0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                                  0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                     0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                                     0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                         0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                                        0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                                       0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                               0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                           0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                           0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                                0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                       00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                     00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                      000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                                     0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                             0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                             0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                                     0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                         000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                                         00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                        0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                        0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                            0000000077713b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                            0000000077713d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                     0000000077714190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                               0000000077761380 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                             0000000077761500 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                   0000000077761530 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                 0000000077761650 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                     0000000077761700 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                     0000000077761d30 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                   0000000077761f80 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                   00000000777627e0 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                 00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                 000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                              00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                                00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                           00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                           00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                                     0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                                       0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                     0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\firefox.exe[8416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                                          0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                             00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                           0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                  000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                  000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                          000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                          0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                         0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                            0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                            0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                               0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                              0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                      0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                  0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                  0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                       0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                              00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                            00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                             000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                            0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                    0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                    0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                            0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                                00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                               0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                               0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                   0000000077713b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                   0000000077713d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                            0000000077714190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                      0000000077761380 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                    0000000077761500 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                          0000000077761530 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                        0000000077761650 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                            0000000077761700 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                            0000000077761d30 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                          0000000077761f80 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                          00000000777627e0 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                        00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                        000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                     00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                       00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                  00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                  00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                            0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                              0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                            0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[7304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                                 0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                             00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                           0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                  000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                  000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                          000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                          0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                         0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                            0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                            0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                               0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                              0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                      0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                  0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                  0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                       0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                              00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                            00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                             000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                            0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...
         

                                                                                                                   * 2
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                    0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                    0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                            0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                                00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                               0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                               0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                   0000000077713b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                   0000000077713d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                            0000000077714190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                      0000000077761380 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                    0000000077761500 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                          0000000077761530 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                        0000000077761650 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                            0000000077761700 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                            0000000077761d30 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                          0000000077761f80 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                          00000000777627e0 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                        00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                        000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                     00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                       00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                  00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                  00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                            0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                              0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                            0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[6416] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                                 0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                             00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                           0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                  000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                  000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                              
  000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                          0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                         0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                            0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                            0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                               0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                              0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                      0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                  0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                  0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                       0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                              00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                            00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                             000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                            0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                    0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                    0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                            0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                                00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                               0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                               0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                   0000000077713b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                   0000000077713d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                            0000000077714190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                      0000000077761380 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                    0000000077761500 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                          0000000077761530 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                        0000000077761650 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                            0000000077761700 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                            0000000077761d30 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                          0000000077761f80 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                          00000000777627e0 8 bytes JMP 3f3f3f3f
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                        00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                        000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                     00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                       00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                  00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                  00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                            0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                              0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                            0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[8160] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                                 0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                                00000000777111f5 8 bytes {JMP 0xd}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                              0000000077711390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                     000000007771143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                     000000007771158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                             000000007771191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                             0000000077711b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                            0000000077711bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                               0000000077711d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                               0000000077711eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                   0000000077711edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                                  0000000077711f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                                 0000000077711fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                         0000000077711fd7 8 bytes {JMP 0xb}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                     0000000077712272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                     0000000077712301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                          0000000077712792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                 00000000777127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                               00000000777127d2 8 bytes {JMP 0x10}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                000000007771282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                               0000000077712890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 2
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                       0000000077712d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                       0000000077712d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                                         * 3
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                               0000000077713023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                   000000007771323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                                   00000000777133c0 16 bytes {JMP 0x4e}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                  0000000077713a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                  0000000077713ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                      0000000077713b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                      0000000077713d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                               0000000077714190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                         0000000077761380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                       0000000077761500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                             0000000077761530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                           0000000077761650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                               0000000077761700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                               0000000077761d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                             0000000077761f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                             00000000777627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                           00000000752213cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                           000000007522146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                        00000000752216d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                          00000000752216e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                     00000000752219db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                     00000000752219fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                               0000000075221a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                                 0000000075221a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                               0000000075221a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\Sabine\Desktop\Malware entfernen\Gmer-19357.exe[7144] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                                    0000000075221a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Processes - GMER 2.1 ----

Library   C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [4124] (Mediencenter Shell Icon Overlay Handler/Deutsche Telekom AG)(2014-06-12 12:59:22)  000007fef1ed0000
Library   C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [4124] (Mediencenter Shell Context Menu Handler/Deutsche Telekom AG)(2014-06-12 12:59:24)  000007fef4850000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [5040]                         0000000056450000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\csi.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [5040]                         0000000050810000
Library   C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\ACEOLEDB.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE [5040]                    00000000507c0000

---- EOF - GMER 2.1 ----
         

127.0.0.1 registeraudials.com
127.0.0.1 registeraudials.com
127.0.0.1 audials.com
127.0.0.1 188.40.53.196
127.0.0.1 lists.rs-audials.com
127.0.0.1 securestore.audials.com
127.0.0.1 secure.element5.com
127.0.0.1 shop.audials.com
127.0.0.1 userstats.audials.com
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 192.150.18.108
127.0.0.1 activate.adobe.com:443
127.0.0.1 3dns.adobe.com
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com

Zuerst deinstallieren wir mal alles an gecrackter Software....

erledigt

mit erledigt meinte ich alles deinstalliert , nicht problem erledigt

Adware & Co. deinstallieren

• Lade Dir bitte von hier Revo Uninstaller herunter.
• Installiere und starte das Programm.
• Suche im Uninstallerfeld nach den Programmen, die unter:
  
  diesen Zusatz haben:
  
• Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:



Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 14-09-16.01 - Sabine 16.09.2014  21:29:46.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8191.4323 [GMT 2:00]
ausgeführt von:: c:\users\Sabine\Desktop\Malware entfernen\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
 ADS - Windows: deleted 192 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\0.bak
C:\install.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\.lnk
c:\users\Sabine\AppData\Roaming\Local
c:\users\Sabine\AppData\Roaming\MSoft
c:\users\Sabine\Documents\21F1C361.tmp
c:\users\Sabine\Documents\Finanzen_2013_5.xls~RF3e5315f7.TMP
c:\users\Sabine\videos\install_icq7.exe
c:\users\Sabine\videos\PC Camera-UA0072_v5.18.1209.109.exe
c:\users\TheDomay\AppData\Roaming\.#
c:\users\TheDomay\AppData\Roaming\.#\MBX@1350@7566F8.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@1350@756708.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@16D4@20766F8.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@16D4@2076708.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@3DC@20C66F8.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@3DC@20C6708.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@974@1F666F8.###
c:\users\TheDomay\AppData\Roaming\.#\MBX@974@1F66708.###
c:\windows\SysWow64\.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-16 bis 2014-09-16  ))))))))))))))))))))))))))))))
.
.
2014-09-16 19:39 . 2014-09-16 19:39	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-09-16 19:39 . 2014-09-16 19:39	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-09-16 19:39 . 2014-09-16 19:39	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2014-09-16 10:01 . 2014-09-16 10:01	--------	d-----w-	c:\windows\ERUNT
2014-09-16 09:08 . 2014-09-16 09:08	--------	d-----w-	c:\program files (x86)\ESET
2014-09-16 07:35 . 2014-09-16 07:38	--------	d-----w-	C:\AdwCleaner
2014-09-16 07:24 . 2014-09-16 07:24	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-09-16 06:12 . 2014-09-16 18:32	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-16 06:11 . 2014-09-16 06:11	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-09-16 06:11 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-09-16 06:11 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-09-16 06:11 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-09-16 06:01 . 2014-09-16 06:01	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-09-15 17:49 . 2014-09-15 18:51	--------	d-----w-	c:\users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 06:05 . 2014-09-15 19:14	--------	d-----w-	C:\FRST
2014-09-10 02:51 . 2014-09-10 02:51	--------	d-----w-	c:\users\TheDomay\AppData\Local\TuneUp Software
2014-09-08 04:40 . 2014-09-08 04:40	--------	d-----w-	c:\users\TheDomay\AppData\Roaming\Nero
2014-09-08 04:40 . 2014-09-08 04:40	--------	d-----w-	c:\users\TheDomay\AppData\Local\Nero
2014-09-08 04:40 . 2014-09-08 04:40	--------	d-----w-	c:\users\TheDomay\AppData\Local\NVIDIA
2014-09-07 19:05 . 2014-08-21 09:24	11319192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{2C3CCF81-FF5B-415F-B54B-8088A6B59FDE}\mpengine.dll
2014-09-07 18:59 . 2014-03-09 21:48	171160	----a-w-	c:\windows\system32\infocardapi.dll
2014-09-07 18:59 . 2014-03-09 21:47	99480	----a-w-	c:\windows\SysWow64\infocardapi.dll
2014-09-07 18:59 . 2014-03-09 21:48	1389208	----a-w-	c:\windows\system32\icardagt.exe
2014-09-07 18:59 . 2014-03-09 21:47	619672	----a-w-	c:\windows\SysWow64\icardagt.exe
2014-09-07 18:59 . 2014-06-30 22:24	8856	----a-w-	c:\windows\system32\icardres.dll
2014-09-07 18:59 . 2014-06-30 22:14	8856	----a-w-	c:\windows\SysWow64\icardres.dll
2014-09-07 18:58 . 2014-06-06 06:16	35480	----a-w-	c:\windows\SysWow64\TsWpfWrp.exe
2014-09-07 18:58 . 2014-06-06 06:12	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-09-07 18:56 . 2014-08-23 02:07	404480	----a-w-	c:\windows\system32\gdi32.dll
2014-09-07 18:56 . 2014-08-23 00:59	3163648	----a-w-	c:\windows\system32\win32k.sys
2014-09-07 18:56 . 2014-08-23 01:45	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-09-07 18:56 . 2014-06-16 02:10	985536	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2014-09-07 18:56 . 2014-07-16 03:23	2048	----a-w-	c:\windows\system32\tzres.dll
2014-09-07 18:56 . 2014-07-16 02:46	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-09-07 18:56 . 2014-06-25 02:05	14175744	----a-w-	c:\windows\system32\shell32.dll
2014-09-07 18:54 . 2014-07-14 02:02	1216000	----a-w-	c:\windows\system32\rpcrt4.dll
2014-09-07 18:54 . 2014-07-14 01:40	664064	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2014-08-31 14:44 . 2014-07-16 08:24	40760	----a-w-	c:\windows\system32\TURegOpt.exe
2014-08-31 14:44 . 2014-07-16 08:24	29496	----a-w-	c:\windows\system32\authuitu.dll
2014-08-31 14:44 . 2014-07-16 08:24	25400	----a-w-	c:\windows\SysWow64\authuitu.dll
2014-08-31 14:44 . 2014-08-31 14:44	--------	d-----w-	c:\users\Sabine\AppData\Local\TuneUp Software
2014-08-31 14:43 . 2014-08-31 14:44	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2014
2014-08-31 14:39 . 2014-08-31 15:07	--------	d-sh--w-	c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-25 08:26 . 2014-08-25 08:26	--------	d-----w-	c:\users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 08:11 . 2014-08-25 08:11	--------	d-----w-	c:\users\Sabine\AppData\Roaming\Peter L Jones
2014-08-21 17:12 . 2013-05-06 07:13	110176	----a-w-	c:\windows\system32\klfphc.dll
2014-08-21 17:11 . 2014-08-21 17:11	--------	d-----w-	c:\windows\ELAMBKUP
2014-08-21 17:11 . 2014-08-21 17:11	--------	d-----w-	c:\program files (x86)\Kaspersky Lab
2014-08-21 17:09 . 2014-08-21 17:22	792128	----a-w-	c:\windows\system32\drivers\klif.sys
2014-08-21 17:09 . 2014-08-21 17:22	140352	----a-w-	c:\windows\system32\drivers\klflt.sys
2014-08-21 17:09 . 2014-04-10 15:25	243808	----a-w-	c:\windows\system32\drivers\klhk.sys
2014-08-21 09:48 . 2014-08-21 09:49	--------	d-----w-	C:\backup
2014-08-19 12:59 . 2014-08-19 12:59	--------	d-sh--w-	c:\users\Sabine\AppData\Local\EmieUserList
2014-08-19 12:59 . 2014-08-19 12:59	--------	d-sh--w-	c:\users\Sabine\AppData\Local\EmieSiteList
2014-08-18 07:00 . 2011-05-13 10:16	493056	----a-w-	c:\windows\SysWow64\dhRichClient3.dll
2014-08-18 07:00 . 2011-03-25 18:42	338432	----a-w-	c:\windows\SysWow64\sqlite36_engine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-10 00:50 . 2012-04-03 10:30	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-10 00:50 . 2011-06-13 12:45	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-07 19:05 . 2012-01-16 10:58	99218768	----a-w-	c:\windows\system32\MRT.exe
2014-08-31 16:07 . 2011-08-06 03:31	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-29 04:55 . 2014-05-27 13:15	590536	----a-w-	c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2014-08-25 04:53 . 2011-05-13 16:59	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-07-25 15:25 . 2014-07-25 15:25	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2014-07-25 15:25 . 2014-07-25 15:25	942592	----a-w-	c:\windows\system32\jsIntl.dll
2014-07-25 15:25 . 2014-07-25 15:25	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2014-07-25 15:25 . 2014-07-25 15:25	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-07-25 15:25 . 2014-07-25 15:25	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2014-07-25 15:25 . 2014-07-25 15:25	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2014-07-25 15:25 . 2014-07-25 15:25	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2014-07-25 15:25 . 2014-07-25 15:25	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2014-07-25 15:25 . 2014-07-25 15:25	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2014-07-25 15:25 . 2014-07-25 15:25	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2014-07-25 15:25 . 2014-07-25 15:25	337408	----a-w-	c:\windows\SysWow64\html.iec
2014-07-25 15:25 . 2014-07-25 15:25	247808	----a-w-	c:\windows\system32\msls31.dll
2014-07-25 15:25 . 2014-07-25 15:25	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2014-07-25 15:25 . 2014-07-25 15:25	235008	----a-w-	c:\windows\system32\elshyph.dll
2014-07-25 15:25 . 2014-07-25 15:25	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2014-07-25 15:25 . 2014-07-25 15:25	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2014-07-25 15:25 . 2014-07-25 15:25	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2014-07-25 15:25 . 2014-07-25 15:25	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2014-07-25 15:25 . 2014-07-25 15:25	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2014-07-25 15:25 . 2014-07-25 15:25	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2014-07-25 15:25 . 2014-07-25 15:25	81408	----a-w-	c:\windows\system32\icardie.dll
2014-07-25 15:25 . 2014-07-25 15:25	774144	----a-w-	c:\windows\system32\jscript.dll
2014-07-25 15:25 . 2014-07-25 15:25	77312	----a-w-	c:\windows\system32\tdc.ocx
2014-07-25 15:25 . 2014-07-25 15:25	62464	----a-w-	c:\windows\system32\pngfilt.dll
2014-07-25 15:25 . 2014-07-25 15:25	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2014-07-25 15:25 . 2014-07-25 15:25	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2014-07-25 15:25 . 2014-07-25 15:25	48640	----a-w-	c:\windows\system32\mshtmler.dll
2014-07-25 15:25 . 2014-07-25 15:25	48128	----a-w-	c:\windows\system32\imgutil.dll
2014-07-25 15:25 . 2014-07-25 15:25	413696	----a-w-	c:\windows\system32\html.iec
2014-07-25 15:25 . 2014-07-25 15:25	30208	----a-w-	c:\windows\system32\licmgr10.dll
2014-07-25 15:25 . 2014-07-25 15:25	243200	----a-w-	c:\windows\system32\webcheck.dll
2014-07-25 15:25 . 2014-07-25 15:25	235520	----a-w-	c:\windows\system32\url.dll
2014-07-25 15:25 . 2014-07-25 15:25	167424	----a-w-	c:\windows\system32\iexpress.exe
2014-07-25 15:25 . 2014-07-25 15:25	147968	----a-w-	c:\windows\system32\occache.dll
2014-07-25 15:25 . 2014-07-25 15:25	143872	----a-w-	c:\windows\system32\wextract.exe
2014-07-25 15:25 . 2014-07-25 15:25	13824	----a-w-	c:\windows\system32\mshta.exe
2014-07-25 15:25 . 2014-07-25 15:25	135680	----a-w-	c:\windows\system32\iepeers.dll
2014-07-25 15:25 . 2014-07-25 15:25	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2014-07-25 15:25 . 2014-07-25 15:25	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2014-07-25 15:25 . 2014-07-25 15:25	105984	----a-w-	c:\windows\system32\iesysprep.dll
2014-07-25 15:25 . 2014-07-25 15:25	101376	----a-w-	c:\windows\system32\inseng.dll
2014-07-25 15:21 . 2014-07-25 15:21	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2014-07-25 15:21 . 2014-07-25 15:21	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2014-07-25 15:21 . 2014-07-25 15:21	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2014-07-25 15:21 . 2014-07-25 15:21	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2014-07-25 15:21 . 2014-07-25 15:21	363008	----a-w-	c:\windows\system32\dxgi.dll
2014-07-25 15:21 . 2014-07-25 15:21	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2014-07-25 15:21 . 2014-07-25 15:21	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	296960	----a-w-	c:\windows\system32\d3d10core.dll
2014-07-25 15:21 . 2014-07-25 15:21	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2014-07-25 15:21 . 2014-07-25 15:21	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2014-07-25 15:21 . 2014-07-25 15:21	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2014-07-25 15:21 . 2014-07-25 15:21	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2014-07-25 15:21 . 2014-07-25 15:21	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2014-07-25 15:21 . 2014-07-25 15:21	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2014-07-25 15:21 . 2014-07-25 15:21	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2014-07-25 15:21 . 2014-07-25 15:21	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2014-07-25 15:21 . 2014-07-25 15:21	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2014-07-25 15:21 . 2014-07-25 15:21	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2014-07-25 15:21 . 2014-07-25 15:21	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2014-07-25 15:21 . 2014-07-25 15:21	1643520	----a-w-	c:\windows\system32\DWrite.dll
2014-07-25 15:21 . 2014-07-25 15:21	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
2014-07-25 15:21 . 2014-07-25 15:21	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2014-07-25 15:21 . 2014-07-25 15:21	1238528	----a-w-	c:\windows\system32\d3d10.dll
2014-07-25 15:21 . 2014-07-25 15:21	1175552	----a-w-	c:\windows\system32\FntCache.dll
2014-07-25 15:21 . 2014-07-25 15:21	1158144	----a-w-	c:\windows\SysWow64\XpsPrint.dll
2014-07-25 15:21 . 2014-07-25 15:21	1080832	----a-w-	c:\windows\SysWow64\d3d10.dll
2014-07-25 15:21 . 2014-07-25 15:21	10752	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-07-25 15:21 . 2014-07-25 15:21	10752	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-06-26 22:52 . 2014-06-26 22:52	829264	----a-w-	c:\windows\system32\msvcr100.dll
2014-06-26 22:52 . 2014-06-26 22:52	608080	----a-w-	c:\windows\system32\msvcp100.dll
2014-06-26 21:32 . 2014-06-26 21:32	773968	----a-w-	c:\windows\SysWow64\msvcr100.dll
2014-06-26 21:32 . 2014-06-26 21:32	421200	----a-w-	c:\windows\SysWow64\msvcp100.dll
2013-11-09 05:18 . 2013-11-09 05:18	12752384	----a-w-	c:\program files (x86)\Common Files\lpuninstall.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-08-07 07:49	233128	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-08-07 07:49	233128	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-08-07 07:49	233128	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"SkyDrive"="c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" [2014-08-07 251040]
"Fitbit Connect"="c:\program files (x86)\Fitbit Connect\Fitbit Connect.exe" [2014-05-19 3414560]
"EADM"="c:\program files (x86)\Origin\Origin.exe" [2014-09-16 3600216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BRMFCWND.EXE" [2009-05-26 1159168]
"snpstd3"="c:\windows\vsnpstd3.exe" [2007-05-10 835584]
"IndexSearch"="c:\program files (x86)\Nuance\PaperPort\IndexSearch.exe" [2010-03-08 46368]
"PaperPort PTD"="c:\program files (x86)\Nuance\PaperPort\pptd40nt.exe" [2010-03-08 29984]
"PDFHook"="c:\program files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe" [2010-03-05 636192]
"PDF5 Registry Controller"="c:\program files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe" [2010-03-05 62752]
"ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2012-09-06 143360]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2012-06-06 3076096]
"Nero MediaHome 4"="c:\program files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-10-26 5178664]
"Fitbit Connect"="c:\program files (x86)\Fitbit Connect\Fitbit Connect.exe" [2014-05-19 3414560]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe"
"ControlCenter3"=c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
"FixCamera"=c:\windows\FixCamera.exe
"DataCardMonitor"=c:\program files (x86)\T-Mobile Internet Manager\DataCardMonitor.exe
"tsnpstd3"=c:\windows\tsnpstd3.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"PPort12reminder"="c:\program files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "c:\programdata\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"
"AcronisTibMounterMonitor"=c:\program files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"KiesTrayAgent"=c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S4 92382931;92382931;c:\windows\system32\DRIVERS\92382931.sys;c:\windows\SYSNATIVE\DRIVERS\92382931.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 00:50]
.
2012-07-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000Core.job
- c:\users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-04 13:49]
.
2012-07-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1505511330-1522540267-1352390042-1000UA.job
- c:\users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-04 13:49]
.
2014-09-16 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-08-07 07:49	260776	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-08-07 07:49	260776	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-08-07 07:49	260776	----a-w-	c:\users\Sabine\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-08-29 04:55	2335960	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-08-29 04:55	2335960	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-08-29 04:55	2335960	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Mediencenter_InSync]
@="{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}]
2014-06-12 12:59	579072	----a-w-	c:\users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Mediencenter_ToSync]
@="{528EE335-5034-4EFC-834E-63E5F02D2BC2}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}]
2014-06-12 12:59	579072	----a-w-	c:\users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Mediencenter_Failed]
@="{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}"
"ReferenceCount"=dword:00000001
[HKEY_CLASSES_ROOT\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}]
2014-06-12 12:59	579072	----a-w-	c:\users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncError]
@="{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}"
[HKEY_CLASSES_ROOT\CLSID\{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}]
2013-10-01 09:32	2818216	----a-w-	c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncInProgress]
@="{00F848DC-B1D4-4892-9C25-CAADC86A215D}"
[HKEY_CLASSES_ROOT\CLSID\{00F848DC-B1D4-4892-9C25-CAADC86A215D}]
2013-10-01 09:32	2818216	----a-w-	c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncOk]
@="{71573297-552E-46fc-BE3D-3DFAF88D47B7}"
[HKEY_CLASSES_ROOT\CLSID\{71573297-552E-46fc-BE3D-3DFAF88D47B7}]
2013-10-01 09:32	2818216	----a-w-	c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-03-20 1797064]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://www.google.de/keyword/%s
mSearchAssistant = www.google.com
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office15\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Free YouTube Download - c:\users\Sabine\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: LastPass - file://c:\users\Sabine\AppData\LocalLow\LastPass\context.html?cmd=lastpass
IE: LastPass Ausfüllformulare - file://c:\users\Sabine\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Mit PDF Viewer Plus öffnen - c:\program files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~3\MIF5BA~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office15\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.startup.homepage - hxxp://www.kadaza.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{0C37B053-FD68-456a-82E1-D788EE342E6F} - (no file)
HKLM_Wow6432Node-ActiveSetup-{98595F74-7670-4CC6-810F-57AFA47222B0} - msiexec
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\w7Svc]
"ImagePath"="c:\program files (x86)\webcam 7\wService.exe /startedbyscm:5053B757-40E35B3B-webcam7SRV"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\EAC3.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,0e,d4,b8,03,08,52,43,92,1b,01,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,0e,d4,b8,03,08,52,43,92,1b,01,\
.
[HKEY_USERS\S-1-5-21-1505511330-1522540267-1352390042-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b8,e9,1b,ff,79,35,ac,f8,c4,fd,82,fc,1c,5a,ef,64,46,8a,7d,5f,54,a9,6b,
   02,75,03,09,7b,b4,6d,26,4c,84,bc,56,a9,13,25,33,9f,bf,fc,3b,aa,85,96,6f,ee,\
"??"=hex:ca,b9,55,79,94,5b,b3,d7,56,ca,88,2c,18,7d,c4,ba
.
[HKEY_USERS\S-1-5-21-1505511330-1522540267-1352390042-1000\Software\SecuROM\License information*]
"datasecu"=hex:85,48,39,5d,df,bf,b7,9c,3a,b5,b3,d7,b4,42,9e,34,f0,5c,fc,ee,bd,
   83,e2,ee,59,1d,53,a1,60,34,2b,5c,70,06,68,1b,45,8a,54,55,c8,07,cc,df,94,f7,\
"rkeysecu"=hex:11,fa,37,45,bd,9c,96,95,c4,dc,15,99,74,df,16,bd
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\06\03\01\07\0d:?"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-09-16  21:43:12
ComboFix-quarantined-files.txt  2014-09-16 19:43
.
Vor Suchlauf: 17 Verzeichnis(se), 98.116.169.728 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 119.776.575.488 Bytes frei
.
- - End Of File - - 5274C435BDC89018F3E2844DAD4F69C7
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 17.09.2014
Suchlauf-Zeit: 21:58:11
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.17.08
Rootkit Datenbank: v2014.09.15.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Sabine

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 512332
Verstrichene Zeit: 13 Min, 54 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         

# AdwCleaner v3.310 - Bericht erstellt am 17/09/2014 um 22:27:36
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Sabine - THEDOMAY-PC
# Gestartet von : C:\Users\Sabine\Desktop\Malware entfernen\AdwCleaner_3.310.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v32.0.1 (x86 de)

[ Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\wk28tnlh.default\prefs.js ]


[ Datei : C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\prefs.js ]


[ Datei : C:\Users\TheDomay\AppData\Roaming\Mozilla\Firefox\Profiles\8cmfikf7.default\prefs.js ]


*************************

AdwCleaner[R1].txt - [16428 octets] - [16/09/2014 09:35:32]
AdwCleaner[R2].txt - [1256 octets] - [17/09/2014 22:18:52]
AdwCleaner[S1].txt - [16117 octets] - [16/09/2014 09:38:19]
AdwCleaner[S2].txt - [1134 octets] - [17/09/2014 22:27:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1194 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.5 (09.16.2014:1)
OS: Windows 7 Home Premium x64
Ran by Sabine on 17.09.2014 at 22:36:18,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\fixcleaner



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish games"
Successfully deleted: [Folder] "C:\Users\Sabine\AppData\Roaming\software informer"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Sabine\appdata\local\{879035A3-9254-4440-B083-70452E3483BD}



~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Sabine\AppData\Roaming\mozilla\firefox\profiles\1zeoos5x.default-1351749639854\minidumps [138 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.09.2014 at 22:45:13,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Sabine (administrator) on THEDOMAY-PC on 17-09-2014 22:47:10
Running from C:\Users\Sabine\Desktop\Malware entfernen
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
() C:\Windows\vsnpstd3.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Bdrive Inc.) C:\Program Files\NetDrive\ndsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe
() C:\Windows\vsnpstd3.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BRMFCWND.EXE [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [snpstd3] => C:\Windows\vsnpstd3.exe [835584 2007-05-10] ()
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Nero MediaHome 4] => C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe [5178664 2010-10-26] (Nero AG)
HKLM-x32\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [OscarEditor] => C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2865152 2008-07-30] ()
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [Eye-Fi] => C:\Program Files (x86)\Eye-Fi\Helper\EyeFiHelper.exe [3961464 2011-12-22] (Eye-Fi, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [Facebook Update] => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-13] (Facebook Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [] => [X]
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [PC Suite Tray] => C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe [1516632 2012-06-26] (Nokia)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {4dfd2b4f-2126-11e4-903a-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {643abe45-ed9b-11e0-aaa7-f46d04d4169c} - F:\USBAutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {733566c8-1d9d-11e1-83cb-f46d04d4169c} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {91c11a80-0f85-11e1-837e-f46d04d4169c} - F:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {bbe385c8-7d79-11e0-abc1-806e6f6e6963} - E:\start.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {e13451bd-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {e13451cc-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [SkyDrive] => C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-08-07] (Microsoft Corporation)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-09-16] (Electronic Arts)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE64.ols (OpenLimit SignCubes AG)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MHTBPos00 Class -> {0C37B053-FD68-456a-82E1-D788EE342E6F} ->  No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854
FF Homepage: hxxp://www.kadaza.de/
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*'))%20%7B%20return%20'PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-1505511330-1522540267-1352390042-1008\FireFox\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fire IE - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\fireie@fireie.org [2014-06-18]
FF Extension: LastPass - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\support@lastpass.com [2014-08-20]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-02-05]
FF Extension: PAYBACK Toolbar - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\toolbar-ff@payback.de.xpi [2013-08-02]
FF Extension: Session Manager - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2012-11-01]
FF Extension: Adblock Plus - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-07]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-09-12]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-12]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [{4F3D26C8-9907-48ff-BC74-B8C572D317BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [{4F0963A3-1658-4fde-9585-23A25CC288BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址過濾 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Sicherer Zahlungsverkehr - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-21]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2369720 2014-08-01] (Microsoft Corporation)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [1436192 2014-05-19] (Fitbit, Inc.)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [8704 2012-07-12] (Hi-Rez Studios) [File not signed]
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-04-02] (Nero AG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 ndsvc; C:\Program Files\NetDrive\ndsvc.exe [2789376 2013-02-25] (Bdrive Inc.) [File not signed]
R2 NeroMediaHomeService.4; C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe [517416 2010-10-26] (Nero AG)
R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [64512 2010-11-26] (Nalpeiron Ltd.) [File not signed]
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 w7Svc; C:\Program Files (x86)\webcam 7\wService.exe [5094200 2012-03-26] (Moonware Studios)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [252928 2010-04-30] (Huawei Technologies Co., Ltd.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [140352 2014-08-21] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [792128 2014-08-21] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [18456 2011-07-07] (HandSet Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-17] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 MEMSWEEP2; C:\Windows\system32\EAC3.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 ndfs; C:\Program Files\NetDrive\ndfs.sys [63712 2013-02-01] (Bdrive Inc.)
R1 networx; C:\Windows\System32\drivers\networx.sys [58360 2013-01-25] (NetFilterSDK.com)
S1 SAVRKBootTasks; C:\Windows\SysWOW64\SAVRKBootTasks.sys [18816 2009-06-18] (Sophos Plc) [File not signed]
S1 SSHDRV65; C:\Windows\SysWOW64\drivers\SSHDRV65.sys [120320 2011-05-14] () [File not signed]
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-03-22] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-03-22] (Acronis International GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-06-23] (TuneUp Software)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2010-10-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2010-10-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2010-10-21] (LG Electronics Inc.)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-03-22] (Acronis International GmbH)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [129432 2011-09-13] (ZTE Incorporated)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Gun; \??\C:\Game\SoftnyxGame\GunBoundIS\Gun64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
S3 sj; \??\C:\AeriaGames\EdenEternal\sjcs64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-17 22:45 - 2014-09-17 22:45 - 00001289 _____ () C:\Users\Sabine\Desktop\JRT.txt
2014-09-17 22:35 - 2014-09-16 15:17 - 01016035 _____ (Thisisu) C:\Users\Sabine\Desktop\JRT_NEW.exe
2014-09-17 13:05 - 2014-09-17 13:05 - 00000000 ____D () C:\Users\Sabine\AppData\Local\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00001098 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00001078 _____ () C:\Users\Public\Desktop\PDF24 Fax.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-17 13:03 - 2014-09-17 13:03 - 16319576 _____ (Geek Software GmbH ) C:\Users\Sabine\Desktop\pdf24-creator-6.7.0.exe
2014-09-16 21:43 - 2014-09-16 21:43 - 00037555 _____ () C:\ComboFix.txt
2014-09-16 21:25 - 2014-09-16 21:43 - 00000000 ____D () C:\ComboFix
2014-09-16 21:25 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-16 21:25 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-16 21:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-16 21:24 - 2014-09-16 21:43 - 00000000 ____D () C:\Qoobox
2014-09-16 21:22 - 2014-09-16 21:40 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 12:01 - 2014-09-16 12:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-16 11:20 - 2014-09-16 12:14 - 00000650 ___SH () C:\Windows\de_cleaner_kasperskydrv.spi
2014-09-16 11:08 - 2014-09-16 11:08 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-16 09:35 - 2014-09-17 22:27 - 00000000 ____D () C:\AdwCleaner
2014-09-16 09:24 - 2014-09-16 09:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-09-16 08:12 - 2014-09-17 22:34 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-16 08:11 - 2014-09-16 08:11 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-16 08:11 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-16 08:11 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-16 08:01 - 2014-09-16 08:01 - 00001283 _____ () C:\Users\Sabine\Desktop\Revo Uninstaller.lnk
2014-09-16 08:01 - 2014-09-16 08:01 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-16 07:16 - 2014-09-16 07:16 - 01101648 _____ () C:\Users\Sabine\Desktop\DE Cleaner powered by Kaspersky - CHIP-Installer.exe
2014-09-15 19:49 - 2014-09-15 20:51 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 08:28 - 2014-09-15 08:28 - 00000000 ____D () C:\Users\Sabine\Desktop\Neuer Ordner
2014-09-15 08:24 - 2014-09-15 08:25 - 00336944 _____ () C:\Windows\Minidump\091514-23166-01.dmp
2014-09-15 08:24 - 2014-09-15 08:24 - 1020992941 _____ () C:\Windows\MEMORY.DMP
2014-09-15 08:22 - 2014-09-16 13:39 - 00002051 _____ () C:\Users\Sabine\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-09-15 08:22 - 2014-09-16 13:39 - 00001995 _____ () C:\Users\Sabine\Desktop\Avira EU-Cleaner.lnk
2014-09-15 08:05 - 2014-09-17 22:47 - 00000000 ____D () C:\FRST
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:00 - 2014-09-17 22:47 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-14 23:35 - 2014-09-14 23:40 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 23:28 - 2002-01-02 22:01 - 00000285 _____ () C:\Users\TheDomay\Desktop\rules_regeln.txt
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:26 - 2014-09-14 10:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:02 - 2014-09-12 23:03 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-07 20:59 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-07 20:59 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-09-07 20:59 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-07 20:59 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-09-07 20:58 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-09-07 20:58 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-09-07 20:57 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-07 20:57 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-07 20:57 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-07 20:57 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-07 20:57 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-07 20:57 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-07 20:57 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-07 20:57 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-07 20:57 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-07 20:57 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-07 20:57 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-07 20:57 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-07 20:57 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-07 20:57 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-07 20:57 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-07 20:57 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-07 20:57 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-07 20:57 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-07 20:57 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-07 20:57 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-09-07 20:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-09-07 20:56 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-07 20:56 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-09-07 20:56 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-07 20:56 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-07 20:56 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-07 20:56 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-07 20:56 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-09-07 20:56 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-09-07 20:54 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-09-07 20:54 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-09-05 05:42 - 2014-09-12 22:55 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-03 06:15 - 2014-09-13 09:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-08-31 16:44 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-08-31 16:44 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-08-31 16:43 - 2014-08-31 16:44 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:39 - 2014-08-31 17:07 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-30 21:14 - 2014-07-22 09:45 - 00000000 ____D () C:\Users\Sabine\Desktop\TuneUp Utilities 2014 v14.0.1000.340
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:12 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 19:09 - 2014-08-21 19:22 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:09 - 2014-08-21 19:22 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:09 - 2014-04-10 17:25 - 00243808 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-08-21 18:29 - 2014-08-21 18:33 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:48 - 2014-08-21 11:49 - 00000000 ____D () C:\backup
2014-08-20 16:11 - 2014-08-20 16:12 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:50 - 2014-08-25 10:23 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieUserList
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieSiteList
2014-08-19 09:42 - 2014-08-19 09:42 - 00004741 _____ () C:\Users\Sabine\Desktop\Mods - Verknüpfung.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000577 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2014-08-18 09:00 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-08-18 09:00 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-17 22:47 - 2014-09-15 08:05 - 00000000 ____D () C:\FRST
2014-09-17 22:47 - 2014-09-15 08:00 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-17 22:45 - 2014-09-17 22:45 - 00001289 _____ () C:\Users\Sabine\Desktop\JRT.txt
2014-09-17 22:39 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-17 22:39 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-17 22:36 - 2011-05-13 18:01 - 01896392 _____ () C:\Windows\WindowsUpdate.log
2014-09-17 22:34 - 2014-09-16 08:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-17 22:34 - 2014-08-15 07:13 - 00000000 ____D () C:\ProgramData\Origin
2014-09-17 22:34 - 2014-05-27 15:34 - 00005152 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for TheDomay-PC-Sabine TheDomay-PC
2014-09-17 22:32 - 2014-03-05 09:55 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-17 22:31 - 2014-08-15 07:12 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-17 22:31 - 2014-05-27 15:28 - 00000000 ___RD () C:\Users\Sabine\OneDrive
2014-09-17 22:31 - 2013-09-12 15:59 - 00036937 _____ () C:\ndsvc.log
2014-09-17 22:29 - 2014-08-11 07:45 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-09-17 22:29 - 2014-05-08 17:58 - 01247022 _____ () C:\Windows\PFRO.log
2014-09-17 22:29 - 2014-04-21 01:00 - 00014145 _____ () C:\Windows\setupact.log
2014-09-17 22:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-17 22:27 - 2014-09-16 09:35 - 00000000 ____D () C:\AdwCleaner
2014-09-17 21:50 - 2012-10-09 15:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-17 13:05 - 2014-09-17 13:05 - 00000000 ____D () C:\Users\Sabine\AppData\Local\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00001098 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00001078 _____ () C:\Users\Public\Desktop\PDF24 Fax.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-17 13:03 - 2014-09-17 13:03 - 16319576 _____ (Geek Software GmbH ) C:\Users\Sabine\Desktop\pdf24-creator-6.7.0.exe
2014-09-17 11:00 - 2013-02-07 12:02 - 00685056 ___SH () C:\Users\Sabine\Desktop\Thumbs.db
2014-09-16 21:43 - 2014-09-16 21:43 - 00037555 _____ () C:\ComboFix.txt
2014-09-16 21:43 - 2014-09-16 21:25 - 00000000 ____D () C:\ComboFix
2014-09-16 21:43 - 2014-09-16 21:24 - 00000000 ____D () C:\Qoobox
2014-09-16 21:43 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-16 21:40 - 2014-09-16 21:22 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 21:39 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-16 15:17 - 2014-09-17 22:35 - 01016035 _____ (Thisisu) C:\Users\Sabine\Desktop\JRT_NEW.exe
2014-09-16 13:39 - 2014-09-15 08:22 - 00002051 _____ () C:\Users\Sabine\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-09-16 13:39 - 2014-09-15 08:22 - 00001995 _____ () C:\Users\Sabine\Desktop\Avira EU-Cleaner.lnk
2014-09-16 12:14 - 2014-09-16 11:20 - 00000650 ___SH () C:\Windows\de_cleaner_kasperskydrv.spi
2014-09-16 12:01 - 2014-09-16 12:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-16 11:08 - 2014-09-16 11:08 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-16 09:42 - 2014-03-15 01:58 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\HTC MediaHub
2014-09-16 09:41 - 2009-07-14 06:45 - 05178408 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-16 09:40 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Performance
2014-09-16 09:24 - 2014-09-16 09:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-09-16 08:11 - 2014-09-16 08:11 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2013-09-07 08:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-16 08:01 - 2014-09-16 08:01 - 00001283 _____ () C:\Users\Sabine\Desktop\Revo Uninstaller.lnk
2014-09-16 08:01 - 2014-09-16 08:01 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-16 07:25 - 2012-09-28 22:28 - 00132304 _____ () C:\Users\Sabine\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-16 07:16 - 2014-09-16 07:16 - 01101648 _____ () C:\Users\Sabine\Desktop\DE Cleaner powered by Kaspersky - CHIP-Installer.exe
2014-09-15 21:08 - 2011-05-26 17:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-15 21:07 - 2014-06-20 15:33 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Adobe
2014-09-15 20:51 - 2014-09-15 19:49 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 09:56 - 2011-05-14 17:39 - 00000000 ____D () C:\Users\TheDomay\Documents\Anki
2014-09-15 08:29 - 2013-06-01 06:59 - 00000000 ____D () C:\Users\Sabine\AppData\Local\HTC MediaHub
2014-09-15 08:28 - 2014-09-15 08:28 - 00000000 ____D () C:\Users\Sabine\Desktop\Neuer Ordner
2014-09-15 08:25 - 2014-09-15 08:24 - 00336944 _____ () C:\Windows\Minidump\091514-23166-01.dmp
2014-09-15 08:24 - 2014-09-15 08:24 - 1020992941 _____ () C:\Windows\MEMORY.DMP
2014-09-15 08:24 - 2012-04-24 22:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-15 08:24 - 2011-08-14 17:41 - 00000000 ____D () C:\Windows\Minidump
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:04 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine
2014-09-14 23:40 - 2014-09-14 23:35 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 10:50 - 2014-09-12 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-14 10:50 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Macromedia
2014-09-13 09:32 - 2014-09-03 06:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:25 - 2011-05-13 22:02 - 00132696 _____ () C:\Users\TheDomay\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000982 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\UpdatusUser\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\TheDomay\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\Administrator\Desktop\Anki.lnk
2014-09-12 23:03 - 2014-09-12 23:02 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-12 22:55 - 2014-09-05 05:42 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-11 14:56 - 2012-10-27 17:35 - 00000000 ____D () C:\Users\Sabine\Desktop\Studium
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-10 04:51 - 2011-05-14 12:24 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\TuneUp Software
2014-09-10 02:50 - 2012-10-09 15:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 02:50 - 2012-04-03 12:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 02:50 - 2011-06-13 14:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-09 12:01 - 2011-05-14 12:21 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-09-09 08:51 - 2009-07-14 19:58 - 00702954 _____ () C:\Windows\system32\perfh007.dat
2014-09-09 08:51 - 2009-07-14 19:58 - 00150612 _____ () C:\Windows\system32\perfc007.dat
2014-09-09 08:51 - 2009-07-14 07:13 - 01629370 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-08 21:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-08 06:39 - 2014-07-26 08:23 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-09-08 06:39 - 2011-05-13 18:36 - 00001440 _____ () C:\Users\TheDomay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-08 06:38 - 2011-11-15 17:48 - 00000000 ____D () C:\Users\TheDomay\.android
2014-09-08 06:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-07 21:14 - 2014-07-25 15:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-07 21:05 - 2012-01-16 12:58 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-07 10:22 - 2013-04-25 08:44 - 00041494 _____ () C:\Users\Administrator\Downloads\Feiertage_DE.ics
2014-09-05 14:59 - 2014-08-15 07:24 - 00000000 ____D () C:\Users\Sabine\Documents\Electronic Arts
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-05 05:42 - 2011-11-02 14:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-05 05:10 - 2014-08-15 07:14 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-09-01 07:34 - 2013-11-18 13:00 - 00000000 ____D () C:\Users\Sabine\Bilder für Bine
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 17:07 - 2014-08-31 16:39 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-31 17:07 - 2014-07-23 13:23 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Mobile Master
2014-08-31 17:07 - 2013-02-22 18:15 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Downloaded Installations
2014-08-31 17:07 - 2012-02-26 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftnyxGame
2014-08-31 17:07 - 2011-11-02 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foto und Video
2014-08-31 17:07 - 2011-06-21 16:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-31 17:07 - 2011-06-06 00:16 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-08-31 16:43 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:44 - 2012-10-01 11:19 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\TuneUp Software
2014-08-31 06:25 - 2014-07-18 12:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-30 09:03 - 2013-11-27 07:14 - 00000000 ____D () C:\Users\Sabine\Documents\Arbeitszeiten-Netto
2014-08-26 21:14 - 2014-08-15 07:24 - 00001502 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:23 - 2014-08-20 06:50 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-25 06:53 - 2011-05-13 18:59 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 17:13 - 2014-02-02 11:52 - 00000000 ____D () C:\Users\Sabine\Documents\Dominik Studium
2014-08-24 12:40 - 2013-05-08 12:59 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-08-23 04:07 - 2014-09-07 20:56 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-09-07 20:56 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-09-07 20:56 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 18:33 - 2014-08-21 18:29 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:49 - 2014-08-21 11:48 - 00000000 ____D () C:\backup
2014-08-21 09:16 - 2012-12-13 08:05 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Notepad++
2014-08-21 09:16 - 2012-12-13 08:03 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-08-20 16:12 - 2014-08-20 16:11 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:24 - 2012-10-03 12:56 - 00000000 ____D () C:\Users\Sabine\Documents\Mein Steuer-Sparbuch Heute
2014-08-20 06:24 - 2011-08-22 03:45 - 00000000 ____D () C:\Fraps
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieUserList
2014-08-19 14:59 - 2014-08-19 14:59 - 00000000 __SHD () C:\Users\Sabine\AppData\Local\EmieSiteList
2014-08-19 09:42 - 2014-08-19 09:42 - 00004741 _____ () C:\Users\Sabine\Desktop\Mods - Verknüpfung.lnk
2014-08-18 18:01 - 2012-12-09 07:06 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Apple Computer
2014-08-18 09:00 - 2014-08-18 09:00 - 00000577 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-08-18 09:00 - 2014-08-18 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps

Files to move or delete:
====================
C:\Users\Sabine\jre-7u7-windows-x64.exe


Some content of TEMP:
====================
C:\Users\Sabine\AppData\Local\Temp\Quarantine.exe
C:\Users\TheDomay\AppData\Local\Temp\NEventMessages.dll
C:\Users\TheDomay\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-16 05:39

==================== End Of Log ============================
         

--- --- ---


Danke und Gruß Bine
--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=0eac253b616e244187eda794bfd637d1
# engine=20175
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-16 07:19:18
# local_time=2014-09-16 09:19:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 56559 162525008 0 0
# scanned=519356
# found=22
# cleaned=0
# scan_time=36513
sh=D676A34DC198D344AAC505C7C55432D9B83A2BCA ft=1 fh=3d25179faed50106 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1505511330-1522540267-1352390042-1000\$RE66GP4.exe"
sh=0C48AD5FD960B6737DECE15B75EB869457AE30DB ft=1 fh=0ec49c36d9645849 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1505511330-1522540267-1352390042-1000\$RIUVE4D.exe"
sh=0C48AD5FD960B6737DECE15B75EB869457AE30DB ft=1 fh=0ec49c36d9645849 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1505511330-1522540267-1352390042-1000\$RPXALM5.exe"
sh=1534373A7B6D68811F74C848937BC2E1A721611B ft=1 fh=e1b9a4173fb1f469 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1505511330-1522540267-1352390042-1000\$RQAUX4Y.exe"
sh=89F2FCA9B5C0DF3A157BB438D5E19E39C4DB4421 ft=0 fh=0000000000000000 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1505511330-1522540267-1352390042-1000\$RXIRDU3.zip"
sh=A766B1AEC38F04D84D73B28D4EEE5071F98EAB25 ft=1 fh=41f78b6c7a2c71bf vn="Win32/Adware.RK.AO.Gen Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\bmg(1).exe"
sh=BED7A7438D6ECED85D3EEE60E7E0B82D488BE9D6 ft=1 fh=9425cacc83ad77c4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\FreeYouTubeDownload_3.1.38.1005.exe"
sh=52F814443453A0453C2FE9D88A881514EEF299A0 ft=1 fh=a4842f99aaa50cda vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\iLividSetup.exe"
sh=10BE6250E3C447C229AB4400B2416DC521BD9D40 ft=1 fh=e9965b2bccb9f6ad vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\isobuster_all_lang.exe"
sh=CB20DFD703B61B9470BBB3B1BE157D47A8C0849A ft=1 fh=63788d9fe9c2f077 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\Shockwave_Installer_Slim.exe"
sh=ACA3551D677477970EE249900FC6C51FA0E39945 ft=1 fh=d4c9c8069ee6d111 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\SweetHome3D-3.7-windows-oc.exe"
sh=3782B323F9F5AC9B84D6E44ACF53A2BEA18CF699 ft=1 fh=1a6b657ebc26c5d2 vn="Win32/DownWare.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\VisualBeeInstall{mmgince}.exe"
sh=8784F4DBA9D7F1F7F8A6049FFC4FCA2F233B5772 ft=1 fh=d8a9f0d3f81799d6 vn="Win32/WinloadSDA.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Documents\Kontoauszüge Postbank\2014\Der-Einsatzplaner-lnstall.exe"
sh=A981E3D6F03D3BD57D1472F33A4093A01533F8A8 ft=1 fh=7aaf7b3d0491af48 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Pictures\bilder für kontakte\wzmp_8.exe"
sh=ADF4B1ABD11130539A2D8DA9DDE39A63D9E07C86 ft=1 fh=e1af97ffad0e8393 vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\dffsetup-physxloader.exe"
sh=44784A497A8C154D455F19A72AED4A9543D768FD ft=1 fh=9ff3a83f3474ac28 vn="Variante von Win32/Adware.Trymedia.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\FINALFANTASYVII-dm.exe"
sh=B662EE7DF1E0B040B8B6BA986C73A278647B94D9 ft=1 fh=a0d009293ed74dab vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\SetupImgBurn_2.5.6.0.exe"
sh=439970C503F460E7DABB0D661038BD411A5C6D61 ft=1 fh=d05fceba4f9328be vn="Variante von Win32/KillProc.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\FixCamera.exe"
sh=ABEFFED266C5E6DD86515CF0440AF46CCFFACC4D ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="G:\Internetprogramme\pfconfig_v1.0.296.rar"
sh=D9AFA784D5DA260E517217130D0DD2E604A6CA08 ft=0 fh=0000000000000000 vn="Variante von Win32/Kryptik.BOI Trojaner" ac=I fn="G:\Internetprogramme\AcrTruImaHom146868AIO\Acronis.True.Image.Home.v14.0.0.6868.AIO.iso"
sh=08D7A96201DD12FEB206EEF76646210801333B09 ft=1 fh=19c1aa6dd4b03407 vn="Variante von Win32/Kryptik.BOI Trojaner" ac=I fn="G:\Internetprogramme\AcrTruImaHom146868AIO\Acronis.True.Image.Home.v14.0.0.6868.AIO\Install Media Add-Ons\4TSAE30 - ATIH2011Addons_de-DE.exe"
sh=5C7EC8B1CAD069870E25A43D0A387B8DBACFAB18 ft=1 fh=9af7ac74720b5755 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="G:\Internetprogramme\pfconfig_v1.0.296\pfconfig_v1.0.296\PFCSetup.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=0eac253b616e244187eda794bfd637d1
# engine=20217
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-18 09:37:19
# local_time=2014-09-18 11:37:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 162706089 0 0
# scanned=540129
# found=16
# cleaned=0
# scan_time=23115
sh=A766B1AEC38F04D84D73B28D4EEE5071F98EAB25 ft=1 fh=41f78b6c7a2c71bf vn="Win32/Adware.RK.AO.Gen Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\bmg(1).exe"
sh=BED7A7438D6ECED85D3EEE60E7E0B82D488BE9D6 ft=1 fh=9425cacc83ad77c4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\FreeYouTubeDownload_3.1.38.1005.exe"
sh=10BE6250E3C447C229AB4400B2416DC521BD9D40 ft=1 fh=e9965b2bccb9f6ad vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\isobuster_all_lang.exe"
sh=CB20DFD703B61B9470BBB3B1BE157D47A8C0849A ft=1 fh=63788d9fe9c2f077 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\Shockwave_Installer_Slim.exe"
sh=ACA3551D677477970EE249900FC6C51FA0E39945 ft=1 fh=d4c9c8069ee6d111 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Sabine\Desktop\Downloads\SweetHome3D-3.7-windows-oc.exe"
sh=8784F4DBA9D7F1F7F8A6049FFC4FCA2F233B5772 ft=1 fh=d8a9f0d3f81799d6 vn="Win32/WinloadSDA.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Documents\Kontoauszüge Postbank\2014\Der-Einsatzplaner-lnstall.exe"
sh=A981E3D6F03D3BD57D1472F33A4093A01533F8A8 ft=1 fh=7aaf7b3d0491af48 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sabine\Pictures\bilder für kontakte\wzmp_8.exe"
sh=ADF4B1ABD11130539A2D8DA9DDE39A63D9E07C86 ft=1 fh=e1af97ffad0e8393 vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\dffsetup-physxloader.exe"
sh=44784A497A8C154D455F19A72AED4A9543D768FD ft=1 fh=9ff3a83f3474ac28 vn="Variante von Win32/Adware.Trymedia.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\FINALFANTASYVII-dm.exe"
sh=B662EE7DF1E0B040B8B6BA986C73A278647B94D9 ft=1 fh=a0d009293ed74dab vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\TheDomay\Downloads\SetupImgBurn_2.5.6.0.exe"
sh=439970C503F460E7DABB0D661038BD411A5C6D61 ft=1 fh=d05fceba4f9328be vn="Variante von Win32/KillProc.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\FixCamera.exe"
sh=ABEFFED266C5E6DD86515CF0440AF46CCFFACC4D ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="G:\Internetprogramme\pfconfig_v1.0.296.rar"
sh=D9AFA784D5DA260E517217130D0DD2E604A6CA08 ft=0 fh=0000000000000000 vn="Variante von Win32/Kryptik.BOI Trojaner" ac=I fn="G:\Internetprogramme\AcrTruImaHom146868AIO\Acronis.True.Image.Home.v14.0.0.6868.AIO.iso"
sh=08D7A96201DD12FEB206EEF76646210801333B09 ft=1 fh=19c1aa6dd4b03407 vn="Variante von Win32/Kryptik.BOI Trojaner" ac=I fn="G:\Internetprogramme\AcrTruImaHom146868AIO\Acronis.True.Image.Home.v14.0.0.6868.AIO\Install Media Add-Ons\4TSAE30 - ATIH2011Addons_de-DE.exe"
sh=5C7EC8B1CAD069870E25A43D0A387B8DBACFAB18 ft=1 fh=9af7ac74720b5755 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="G:\Internetprogramme\pfconfig_v1.0.296\pfconfig_v1.0.296\PFCSetup.exe"
sh=D36FD57DFBDCFCA08F68CAF879EC35F769398044 ft=1 fh=c245a52bc5eb1295 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="H:\Programme für Ebook\ebooktools\PDFXVwer.exe"
         

 Results of screen317's Security Check version 0.99.87  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Sophos Anti-Rootkit 1.5.0   
 TuneUp Utilities 2014   
 TuneUp Utilities Language Pack (de-DE) 
 TuneUp Utilities 2014 (de-DE)  
 TuneUp Utilities 2014   
 Java 7 Update 51  
 Java version out of Date! 
 Adobe Flash Player 15.0.0.152  
 Adobe Reader XI  
 Mozilla Firefox (32.0.1) 
 Mozilla Thunderbird (24.6.0) 
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Sabine Desktop Malware entfernen SecurityCheck.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Sabine (administrator) on THEDOMAY-PC on 19-09-2014 08:09:11
Running from C:\Users\Sabine\Desktop\Malware entfernen
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\runonce.exe
(Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
() C:\Windows\vsnpstd3.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1797064 2014-03-20] (NVIDIA Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BRMFCWND.EXE [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [snpstd3] => C:\Windows\vsnpstd3.exe [835584 2007-05-10] ()
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Nero MediaHome 4] => C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe [5178664 2010-10-26] (Nero AG)
HKLM-x32\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [OscarEditor] => C:\Program Files (x86)\OSCAR Editor\OscarEditor.exe [2865152 2008-07-30] ()
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [Eye-Fi] => C:\Program Files (x86)\Eye-Fi\Helper\EyeFiHelper.exe [3961464 2011-12-22] (Eye-Fi, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [Facebook Update] => C:\Users\TheDomay\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-13] (Facebook Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [] => [X]
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [PC Suite Tray] => C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe [1516632 2012-06-26] (Nokia)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {4dfd2b4f-2126-11e4-903a-f46d04d4169c} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {643abe45-ed9b-11e0-aaa7-f46d04d4169c} - F:\USBAutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {733566c8-1d9d-11e1-83cb-f46d04d4169c} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {91c11a80-0f85-11e1-837e-f46d04d4169c} - F:\AutoRun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.A11B02 PID_0083
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {bbe385c8-7d79-11e0-abc1-806e6f6e6963} - E:\start.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {e13451bd-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1000\...\MountPoints2: {e13451cc-8fe6-11e2-8bf7-f46d04d4169c} - I:\AutoRun.exe
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [SkyDrive] => C:\Users\Sabine\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-08-07] (Microsoft Corporation)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3414560 2014-05-19] (Fitbit, Inc.)
HKU\S-1-5-21-1505511330-1522540267-1352390042-1008\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-09-16] (Electronic Arts)
ShellIconOverlayIdentifiers: 01Mediencenter_InSync -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 02Mediencenter_ToSync -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: 03Mediencenter_Failed -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Sabine\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE64.ols (OpenLimit SignCubes AG)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MHTBPos00 Class -> {0C37B053-FD68-456a-82E1-D788EE342E6F} ->  No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854
FF Homepage: hxxp://www.kadaza.de/
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*'))%20%7B%20return%20'PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-1505511330-1522540267-1352390042-1008\FireFox\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fire IE - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\fireie@fireie.org [2014-06-18]
FF Extension: LastPass - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\support@lastpass.com [2014-08-20]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-02-05]
FF Extension: PAYBACK Toolbar - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\toolbar-ff@payback.de.xpi [2013-08-02]
FF Extension: Session Manager - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2012-11-01]
FF Extension: Adblock Plus - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-12-07]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-09-12]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-09-12]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2014-09-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-12]
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-06-05]
FF HKLM-x32\...\Firefox\Extensions: [{4F3D26C8-9907-48ff-BC74-B8C572D317BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [{4F0963A3-1658-4fde-9585-23A25CC288BF}] - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win
FF Extension: AusweisApp - C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2014-04-06]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Modul zum Sperren von gefährlichen Webseiten - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtuelle Tastatur - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址過濾 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-21]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Sicherer Zahlungsverkehr - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-21]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Sabine\AppData\Roaming\Mozilla\Firefox\Profiles\1zeoos5x.default-1351749639854\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM-x32\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-08]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2369720 2014-08-01] (Microsoft Corporation)
R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [1436192 2014-05-19] (Fitbit, Inc.)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [8704 2012-07-12] (Hi-Rez Studios) [File not signed]
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2014-04-02] (Nero AG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 ndsvc; C:\Program Files\NetDrive\ndsvc.exe [2789376 2013-02-25] (Bdrive Inc.) [File not signed]
R2 NeroMediaHomeService.4; C:\Program Files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe [517416 2010-10-26] (Nero AG)
R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [64512 2010-11-26] (Nalpeiron Ltd.) [File not signed]
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S3 w7Svc; C:\Program Files (x86)\webcam 7\wService.exe [5094200 2012-03-26] (Moonware Studios)
S2 mfevtp; "C:\Windows\system32\mfevtps.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [252928 2010-04-30] (Huawei Technologies Co., Ltd.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [140352 2014-08-21] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [792128 2014-08-21] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [18456 2011-07-07] (HandSet Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
U4 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 MEMSWEEP2; C:\Windows\system32\EAC3.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 ndfs; C:\Program Files\NetDrive\ndfs.sys [63712 2013-02-01] (Bdrive Inc.)
R1 networx; C:\Windows\System32\drivers\networx.sys [58360 2013-01-25] (NetFilterSDK.com)
S1 SAVRKBootTasks; C:\Windows\SysWOW64\SAVRKBootTasks.sys [18816 2009-06-18] (Sophos Plc) [File not signed]
S1 SSHDRV65; C:\Windows\SysWOW64\drivers\SSHDRV65.sys [120320 2011-05-14] () [File not signed]
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-03-22] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-03-22] (Acronis International GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-06-23] (TuneUp Software)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2010-10-21] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2010-10-21] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2010-10-21] (LG Electronics Inc.)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-03-22] (Acronis International GmbH)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [129432 2011-09-13] (ZTE Incorporated)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Gun; \??\C:\Game\SoftnyxGame\GunBoundIS\Gun64.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
R0 mfehidk; system32\drivers\mfehidk.sys [X]
S0 mferkdet; system32\drivers\mferkdet.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]
S3 sj; \??\C:\AeriaGames\EdenEternal\sjcs64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-18 17:26 - 2014-09-18 17:26 - 00000112 ___RH () C:\Users\Sabine\Desktop\Stinger.opt
2014-09-18 16:57 - 2014-09-18 17:26 - 00000000 ____D () C:\Program Files\stinger
2014-09-18 16:57 - 2014-09-18 17:08 - 00000862 _____ () C:\Users\Sabine\Desktop\Stinger_18092014_165719.html
2014-09-18 16:57 - 2014-09-18 16:57 - 00177680 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.8afe.deleteme
2014-09-18 16:56 - 2014-09-18 16:56 - 12402536 _____ (McAfee Inc) C:\Users\Sabine\Desktop\stinger64.exe
2014-09-18 09:14 - 2014-09-18 09:14 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\4750169E.sys
2014-09-17 22:45 - 2014-09-17 22:45 - 00001289 _____ () C:\Users\Sabine\Desktop\JRT.txt
2014-09-17 22:35 - 2014-09-16 15:17 - 01016035 _____ (Thisisu) C:\Users\Sabine\Desktop\JRT_NEW.exe
2014-09-17 13:05 - 2014-09-17 13:05 - 00000000 ____D () C:\Users\Sabine\AppData\Local\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00001098 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00001078 _____ () C:\Users\Public\Desktop\PDF24 Fax.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-17 13:03 - 2014-09-17 13:03 - 16319576 _____ (Geek Software GmbH ) C:\Users\Sabine\Desktop\pdf24-creator-6.7.0.exe
2014-09-16 21:43 - 2014-09-16 21:43 - 00037555 _____ () C:\ComboFix.txt
2014-09-16 21:25 - 2014-09-16 21:43 - 00000000 ____D () C:\ComboFix
2014-09-16 21:25 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-16 21:25 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-16 21:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-16 21:25 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-16 21:24 - 2014-09-16 21:43 - 00000000 ____D () C:\Qoobox
2014-09-16 21:22 - 2014-09-16 21:40 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 12:01 - 2014-09-16 12:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-16 11:20 - 2014-09-16 12:14 - 00000650 ___SH () C:\Windows\de_cleaner_kasperskydrv.spi
2014-09-16 09:35 - 2014-09-17 22:27 - 00000000 ____D () C:\AdwCleaner
2014-09-16 09:24 - 2014-09-16 09:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-09-16 08:12 - 2014-09-19 07:09 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-16 08:11 - 2014-09-16 08:11 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-16 08:11 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-16 08:11 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-16 08:01 - 2014-09-16 08:01 - 00001283 _____ () C:\Users\Sabine\Desktop\Revo Uninstaller.lnk
2014-09-16 08:01 - 2014-09-16 08:01 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-16 07:16 - 2014-09-16 07:16 - 01101648 _____ () C:\Users\Sabine\Desktop\DE Cleaner powered by Kaspersky - CHIP-Installer.exe
2014-09-15 19:49 - 2014-09-15 20:51 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 08:28 - 2014-09-15 08:28 - 00000000 ____D () C:\Users\Sabine\Desktop\Neuer Ordner
2014-09-15 08:24 - 2014-09-15 08:25 - 00336944 _____ () C:\Windows\Minidump\091514-23166-01.dmp
2014-09-15 08:24 - 2014-09-15 08:24 - 1020992941 _____ () C:\Windows\MEMORY.DMP
2014-09-15 08:22 - 2014-09-16 13:39 - 00002051 _____ () C:\Users\Sabine\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-09-15 08:22 - 2014-09-16 13:39 - 00001995 _____ () C:\Users\Sabine\Desktop\Avira EU-Cleaner.lnk
2014-09-15 08:05 - 2014-09-19 08:09 - 00000000 ____D () C:\FRST
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:00 - 2014-09-19 08:09 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-14 23:35 - 2014-09-14 23:40 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 23:28 - 2002-01-02 22:01 - 00000285 _____ () C:\Users\TheDomay\Desktop\rules_regeln.txt
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:26 - 2014-09-14 10:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:02 - 2014-09-12 23:03 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-07 20:59 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-07 20:59 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-09-07 20:59 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-07 20:59 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-09-07 20:59 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-09-07 20:58 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-09-07 20:58 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-09-07 20:57 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-07 20:57 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-07 20:57 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-07 20:57 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-07 20:57 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-07 20:57 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-07 20:57 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-07 20:57 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-07 20:57 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-07 20:57 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-07 20:57 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-07 20:57 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-07 20:57 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-07 20:57 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-07 20:57 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-07 20:57 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-07 20:57 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-07 20:57 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-07 20:57 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-07 20:57 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-07 20:57 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-07 20:57 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-07 20:57 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-07 20:57 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-07 20:57 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-07 20:57 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-07 20:57 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-07 20:57 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-07 20:57 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-07 20:57 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-07 20:57 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-07 20:57 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-07 20:57 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-07 20:57 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-07 20:57 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-07 20:57 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-07 20:57 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-09-07 20:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-09-07 20:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-07 20:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-09-07 20:56 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-07 20:56 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-09-07 20:56 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-07 20:56 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-07 20:56 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-07 20:56 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-07 20:56 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-09-07 20:56 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-09-07 20:54 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-09-07 20:54 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-09-05 05:42 - 2014-09-12 22:55 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-03 06:15 - 2014-09-13 09:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-07-16 10:24 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-08-31 16:44 - 2014-07-16 10:24 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-08-31 16:44 - 2014-07-16 10:24 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-08-31 16:43 - 2014-08-31 16:44 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:39 - 2014-08-31 17:07 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-30 21:14 - 2014-07-22 09:45 - 00000000 ____D () C:\Users\Sabine\Desktop\TuneUp Utilities 2014 v14.0.1000.340
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:12 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-08-21 19:11 - 2014-09-18 09:56 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 19:09 - 2014-08-21 19:22 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:09 - 2014-08-21 19:22 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:09 - 2014-04-10 17:25 - 00243808 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2014-08-21 18:29 - 2014-08-21 18:33 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:48 - 2014-08-21 11:49 - 00000000 ____D () C:\backup
2014-08-20 16:11 - 2014-08-20 16:12 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:50 - 2014-08-25 10:23 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 08:09 - 2014-09-15 08:05 - 00000000 ____D () C:\FRST
2014-09-19 08:09 - 2014-09-15 08:00 - 00000000 ____D () C:\Users\Sabine\Desktop\Malware entfernen
2014-09-19 07:50 - 2012-10-09 15:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-19 07:09 - 2014-09-16 08:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 00:19 - 2014-05-27 15:34 - 00005152 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for TheDomay-PC-Sabine TheDomay-PC
2014-09-18 21:03 - 2012-10-27 17:35 - 00000000 ____D () C:\Users\Sabine\Desktop\Studium
2014-09-18 18:00 - 2014-08-11 07:45 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-09-18 17:26 - 2014-09-18 17:26 - 00000112 ___RH () C:\Users\Sabine\Desktop\Stinger.opt
2014-09-18 17:26 - 2014-09-18 16:57 - 00000000 ____D () C:\Program Files\stinger
2014-09-18 17:08 - 2014-09-18 16:57 - 00000862 _____ () C:\Users\Sabine\Desktop\Stinger_18092014_165719.html
2014-09-18 16:57 - 2014-09-18 16:57 - 00177680 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.8afe.deleteme
2014-09-18 16:57 - 2014-05-27 15:28 - 00000000 ___RD () C:\Users\Sabine\OneDrive
2014-09-18 16:56 - 2014-09-18 16:56 - 12402536 _____ (McAfee Inc) C:\Users\Sabine\Desktop\stinger64.exe
2014-09-18 16:53 - 2014-08-15 07:12 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-18 16:53 - 2014-03-05 09:55 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-18 16:53 - 2011-05-13 18:01 - 01658490 _____ () C:\Windows\WindowsUpdate.log
2014-09-18 14:42 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-18 14:42 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-18 14:34 - 2014-03-15 01:58 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\HTC MediaHub
2014-09-18 14:33 - 2014-04-21 01:00 - 00014257 _____ () C:\Windows\setupact.log
2014-09-18 14:33 - 2013-09-12 15:59 - 00038035 _____ () C:\ndsvc.log
2014-09-18 14:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-18 14:32 - 2014-05-08 17:58 - 01248322 _____ () C:\Windows\PFRO.log
2014-09-18 10:01 - 2014-08-15 07:13 - 00000000 ____D () C:\ProgramData\Origin
2014-09-18 09:56 - 2014-08-21 19:11 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-09-18 09:14 - 2014-09-18 09:14 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\4750169E.sys
2014-09-17 22:45 - 2014-09-17 22:45 - 00001289 _____ () C:\Users\Sabine\Desktop\JRT.txt
2014-09-17 22:27 - 2014-09-16 09:35 - 00000000 ____D () C:\AdwCleaner
2014-09-17 13:05 - 2014-09-17 13:05 - 00000000 ____D () C:\Users\Sabine\AppData\Local\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00001098 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00001078 _____ () C:\Users\Public\Desktop\PDF24 Fax.lnk
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-17 13:04 - 2014-09-17 13:04 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-17 13:03 - 2014-09-17 13:03 - 16319576 _____ (Geek Software GmbH ) C:\Users\Sabine\Desktop\pdf24-creator-6.7.0.exe
2014-09-17 11:00 - 2013-02-07 12:02 - 00685056 ___SH () C:\Users\Sabine\Desktop\Thumbs.db
2014-09-16 21:43 - 2014-09-16 21:43 - 00037555 _____ () C:\ComboFix.txt
2014-09-16 21:43 - 2014-09-16 21:25 - 00000000 ____D () C:\ComboFix
2014-09-16 21:43 - 2014-09-16 21:24 - 00000000 ____D () C:\Qoobox
2014-09-16 21:43 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-16 21:40 - 2014-09-16 21:22 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 21:39 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-16 15:17 - 2014-09-17 22:35 - 01016035 _____ (Thisisu) C:\Users\Sabine\Desktop\JRT_NEW.exe
2014-09-16 13:39 - 2014-09-15 08:22 - 00002051 _____ () C:\Users\Sabine\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-09-16 13:39 - 2014-09-15 08:22 - 00001995 _____ () C:\Users\Sabine\Desktop\Avira EU-Cleaner.lnk
2014-09-16 12:14 - 2014-09-16 11:20 - 00000650 ___SH () C:\Windows\de_cleaner_kasperskydrv.spi
2014-09-16 12:01 - 2014-09-16 12:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-16 09:41 - 2009-07-14 06:45 - 05178408 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-16 09:40 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Performance
2014-09-16 09:24 - 2014-09-16 09:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-09-16 08:11 - 2014-09-16 08:11 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2014-09-16 08:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-16 08:11 - 2013-09-07 08:15 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-16 08:01 - 2014-09-16 08:01 - 00001283 _____ () C:\Users\Sabine\Desktop\Revo Uninstaller.lnk
2014-09-16 08:01 - 2014-09-16 08:01 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-16 07:25 - 2012-09-28 22:28 - 00132304 _____ () C:\Users\Sabine\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-16 07:16 - 2014-09-16 07:16 - 01101648 _____ () C:\Users\Sabine\Desktop\DE Cleaner powered by Kaspersky - CHIP-Installer.exe
2014-09-15 21:08 - 2011-05-26 17:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-15 21:07 - 2014-06-20 15:33 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Adobe
2014-09-15 20:51 - 2014-09-15 19:49 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Nico Mak Computing
2014-09-15 09:56 - 2011-05-14 17:39 - 00000000 ____D () C:\Users\TheDomay\Documents\Anki
2014-09-15 08:29 - 2013-06-01 06:59 - 00000000 ____D () C:\Users\Sabine\AppData\Local\HTC MediaHub
2014-09-15 08:28 - 2014-09-15 08:28 - 00000000 ____D () C:\Users\Sabine\Desktop\Neuer Ordner
2014-09-15 08:25 - 2014-09-15 08:24 - 00336944 _____ () C:\Windows\Minidump\091514-23166-01.dmp
2014-09-15 08:24 - 2014-09-15 08:24 - 1020992941 _____ () C:\Windows\MEMORY.DMP
2014-09-15 08:24 - 2012-04-24 22:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-15 08:24 - 2011-08-14 17:41 - 00000000 ____D () C:\Windows\Minidump
2014-09-15 08:04 - 2014-09-15 08:04 - 00000000 _____ () C:\Users\Sabine\defogger_reenable
2014-09-15 08:04 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine
2014-09-14 23:40 - 2014-09-14 23:35 - 00000109 _____ () C:\Windows\atarigo.ini
2014-09-14 23:28 - 2014-09-14 23:28 - 00000000 ____D () C:\Users\TheDomay\Desktop\atari-go
2014-09-14 10:50 - 2014-09-12 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-14 10:50 - 2012-09-28 22:26 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Macromedia
2014-09-13 09:32 - 2014-09-03 06:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox.bak
2014-09-13 02:51 - 2014-09-13 02:51 - 00000162 ____H () C:\Users\TheDomay\Desktop\~$enDocument Text (neu).odt
2014-09-13 02:25 - 2011-05-13 22:02 - 00132696 _____ () C:\Users\TheDomay\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-13 02:18 - 2014-09-13 02:18 - 00000000 ____D () C:\Users\Sabine\Documents\Anki
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\Sabine\Desktop\Anki.lnk
2014-09-12 23:14 - 2014-09-12 23:14 - 00000970 _____ () C:\Users\NeroMediaHomeUser.4\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000982 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\UpdatusUser\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\TheDomay\Desktop\Anki.lnk
2014-09-12 23:14 - 2013-03-29 15:48 - 00000970 _____ () C:\Users\Administrator\Desktop\Anki.lnk
2014-09-12 23:03 - 2014-09-12 23:02 - 23224070 _____ () C:\Users\TheDomay\Downloads\anki-2.0.28.exe
2014-09-12 22:55 - 2014-09-05 05:42 - 00001357 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-10 04:51 - 2014-09-10 04:51 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\TuneUp Software
2014-09-10 04:51 - 2011-05-14 12:24 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\TuneUp Software
2014-09-10 02:50 - 2012-10-09 15:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 02:50 - 2012-04-03 12:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 02:50 - 2011-06-13 14:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-09 12:01 - 2011-05-14 12:21 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-09-09 08:51 - 2009-07-14 19:58 - 00702954 _____ () C:\Windows\system32\perfh007.dat
2014-09-09 08:51 - 2009-07-14 19:58 - 00150612 _____ () C:\Windows\system32\perfc007.dat
2014-09-09 08:51 - 2009-07-14 07:13 - 01629370 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-08 21:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Roaming\Nero
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\NVIDIA
2014-09-08 06:40 - 2014-09-08 06:40 - 00000000 ____D () C:\Users\TheDomay\AppData\Local\Nero
2014-09-08 06:39 - 2014-09-08 06:39 - 00002349 _____ () C:\Users\TheDomay\Desktop\Sicherer Zahlungsverkehr.lnk
2014-09-08 06:39 - 2014-07-26 08:23 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-09-08 06:39 - 2011-05-13 18:36 - 00001440 _____ () C:\Users\TheDomay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-08 06:38 - 2011-11-15 17:48 - 00000000 ____D () C:\Users\TheDomay\.android
2014-09-08 06:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-07 21:14 - 2014-07-25 15:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-07 21:05 - 2012-01-16 12:58 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-07 10:22 - 2013-04-25 08:44 - 00041494 _____ () C:\Users\Administrator\Downloads\Feiertage_DE.ics
2014-09-05 14:59 - 2014-08-15 07:24 - 00000000 ____D () C:\Users\Sabine\Documents\Electronic Arts
2014-09-05 05:42 - 2014-09-05 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-05 05:42 - 2011-11-02 14:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-05 05:10 - 2014-08-15 07:14 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-09-01 07:34 - 2013-11-18 13:00 - 00000000 ____D () C:\Users\Sabine\Bilder für Bine
2014-09-01 06:15 - 2014-09-01 06:15 - 00002770 _____ () C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2014-08-31 17:07 - 2014-08-31 16:39 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-08-31 17:07 - 2014-07-23 13:23 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Mobile Master
2014-08-31 17:07 - 2013-02-22 18:15 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Downloaded Installations
2014-08-31 17:07 - 2012-02-26 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftnyxGame
2014-08-31 17:07 - 2011-11-02 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foto und Video
2014-08-31 17:07 - 2011-06-21 16:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-31 17:07 - 2011-06-06 00:16 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-08-31 16:44 - 2014-08-31 16:44 - 00002228 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002220 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00002208 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\Users\Sabine\AppData\Local\TuneUp Software
2014-08-31 16:44 - 2014-08-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-08-31 16:44 - 2014-08-31 16:43 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-08-31 16:44 - 2012-10-01 11:19 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\TuneUp Software
2014-08-31 06:25 - 2014-07-18 12:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-30 09:03 - 2013-11-27 07:14 - 00000000 ____D () C:\Users\Sabine\Documents\Arbeitszeiten-Netto
2014-08-26 21:14 - 2014-08-15 07:24 - 00001502 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-25 10:26 - 2014-08-25 10:26 - 00000000 ____D () C:\Users\Sabine\AppData\Local\Peter_L_Jones
2014-08-25 10:23 - 2014-08-20 06:50 - 00000000 ____D () C:\Users\Sabine\Desktop\Dateien für Sims 4
2014-08-25 10:11 - 2014-08-25 10:11 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Peter L Jones
2014-08-25 06:53 - 2011-05-13 18:59 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 17:13 - 2014-02-02 11:52 - 00000000 ____D () C:\Users\Sabine\Documents\Dominik Studium
2014-08-24 12:40 - 2013-05-08 12:59 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-08-23 04:07 - 2014-09-07 20:56 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-09-07 20:56 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-09-07 20:56 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00792128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-08-21 19:22 - 2014-08-21 19:09 - 00140352 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-08-21 19:12 - 2014-08-21 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-08-21 19:11 - 2014-08-21 19:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-08-21 18:33 - 2014-08-21 18:29 - 176561792 _____ () C:\Users\Sabine\Desktop\kis15.0.0.463de-de.exe
2014-08-21 11:49 - 2014-08-21 11:48 - 00000000 ____D () C:\backup
2014-08-21 09:16 - 2012-12-13 08:05 - 00000000 ____D () C:\Users\Sabine\AppData\Roaming\Notepad++
2014-08-21 09:16 - 2012-12-13 08:03 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-08-20 16:12 - 2014-08-20 16:11 - 00000000 ____D () C:\Users\Sabine\Documents\Kalender outlook
2014-08-20 06:24 - 2012-10-03 12:56 - 00000000 ____D () C:\Users\Sabine\Documents\Mein Steuer-Sparbuch Heute
2014-08-20 06:24 - 2011-08-22 03:45 - 00000000 ____D () C:\Fraps

Files to move or delete:
====================
C:\Users\Sabine\jre-7u7-windows-x64.exe


Some content of TEMP:
====================
C:\Users\Sabine\AppData\Local\Temp\npp.6.6.9.Installer.exe
C:\Users\Sabine\AppData\Local\Temp\Quarantine.exe
C:\Users\TheDomay\AppData\Local\Temp\NEventMessages.dll
C:\Users\TheDomay\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-16 05:39

==================== End Of Log ============================
         

--- --- ---


Ich habe mir meine Mail von der Telekom wieder freischalten lassen.
Kann ich Outlook wieder benutzen ?

Danke und Gruß

Bine


--- --- ---

Java updaten. Download Ordner leeren. Outlook kannste benutzen.

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.