Rechenr blockiert sporadisch; iwrd langsamer; hat entsprechende Fehlermeldung in Ereignisanzeigen

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-01-2015 02
Ran by Rene (administrator) on LAPTOP on 14-01-2015 17:11:21
Running from C:\Users\Rene\Downloads
Loaded Profile: Rene (Available profiles: Rene & Mausi & UpdatusUser & sonos)
Platform: Microsoft® Windows Vista™ Business Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\stacsv.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Windows\System32\Locator.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
() C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Creative Technology Ltd.) C:\Windows\OEM13Mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(1&1 Internet AG) C:\Program Files\1&1\1&1 Upload-Manager\DAVSRV.EXE
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\System32\mmc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\mmc.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [OEM13Mon.exe] => C:\Windows\OEM13Mon.exe [36864 2008-01-07] (Creative Technology Ltd.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [483420 2009-03-16] (IDT, Inc.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0xDD000000
HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\Mausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E-Mail - Verknüpfung.lnk
ShortcutTarget: E-Mail - Verknüpfung.lnk -> (No File)
Startup: C:\Users\Mausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Internet - Verknüpfung.lnk
ShortcutTarget: Internet - Verknüpfung.lnk -> (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=frg0203ff&cd=2XzuyEtN2Y1L1QzutDtDtByE0Ezz0CyByE0AtCyCyD0EyB0DtN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyDtC0Azz0Ezz0DyCtGyD0EtByCtGzyyDyC0EtG0C0FtDyDtGtA0ByDyEyDtCtAyE0AzzyDzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzy0DzyyBzztB0FtG0EzyyC0FtG0F0F0E0FtGyD0Dzz0DtGtD0F0BtAzyzyyB0DyE0BtB0D2Q&cr=1045373360&ir=
HKU\S-1-5-21-607557907-3096731163-2526116815-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = 
SearchScopes: HKU\S-1-5-21-607557907-3096731163-2526116815-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=frg0203ff&cd=2XzuyEtN2Y1L1QzutDtDtByE0Ezz0CyByE0AtCyCyD0EyB0DtN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyDtC0Azz0Ezz0DyCtGyD0EtByCtGzyyDyC0EtG0C0FtDyDtGtA0ByDyEyDtCtAyE0AzzyDzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzy0DzyyBzztB0FtG0EzyyC0FtG0F0F0E0FtGyD0Dzz0DtGtD0F0BtAzyzyyB0DyE0BtB0D2Q&cr=1045373360&ir=
SearchScopes: HKU\S-1-5-21-607557907-3096731163-2526116815-1000 -> {33745073-C737-430A-B7AD-FAEDC71F7BE4} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=57625cf3-00c5-4178-8daa-c878a132d507&apn_sauid=6EB329DB-D8A4-4427-8D89-46AD85421FA3
SearchScopes: HKU\S-1-5-21-607557907-3096731163-2526116815-1000 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = https://isearch.avg.com/search?cid={C9426FFE-6C04-40C1-88D4-C620ED72552C}&mid=07e5d0453a0847d0b6c1d16dae23a3e5-88bea68513c636428419fdaca391f6dc89374e68&lang=de&ds=pd011&pr=sa&d=2012-09-21 16:37:38&v=12.2.5.34&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-607557907-3096731163-2526116815-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=frg0203ff&cd=2XzuyEtN2Y1L1QzutDtDtByE0Ezz0CyByE0AtCyCyD0EyB0DtN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyDtC0Azz0Ezz0DyCtGyD0EtByCtGzyyDyC0EtG0C0FtDyDtGtA0ByDyEyDtCtAyE0AzzyDzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzy0DzyyBzztB0FtG0EzyyC0FtG0F0F0E0FtGyD0Dzz0DtGtD0F0BtAzyzyyB0DyE0BtB0D2Q&cr=1045373360&ir=
BHO: No Name -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
Toolbar: HKLM - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-607557907-3096731163-2526116815-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.11.12.13
Tcpip\..\Interfaces\{9B3714FC-C27C-44C3-8300-574815DBDACC}: [NameServer] 10.11.12.13

FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default
FF SearchEngineOrder.1: Mysearchdial
FF Homepage: about:home
FF Keyword.URL: 
FF NetworkProxy: "http", "118.98.172.187"
FF NetworkProxy: "http_port", 31280
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\user.js
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\searchplugins\avira-safesearch.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\searchplugins\google-maps.xml
FF Extension: Avira Browser Safety - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\abs@avira.com [2014-12-12]
FF Extension: Cliqz Beta - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\cliqz@cliqz.com.xpi [2014-12-23]
FF Extension: RefControl - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}.xpi [2013-01-17]
FF Extension: NoScript - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-15]
FF Extension: Adblock Plus - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-01-26]
FF Extension: BetterPrivacy - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012-09-15]
FF Extension: User Agent Switcher - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2013-01-26]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-09-14]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-05-19]
FF HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\aestsrv.exe [81920 2009-03-16] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S4 O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [72224 2009-01-08] (O2Micro International)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\STacSV.exe [249938 2009-03-16] (IDT, Inc.)
R2 WiselinkPro; C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [3007488 2010-02-17] ()
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-30] (Avira Operations GmbH & Co. KG)
S3 GigasetGenericUSB; C:\Windows\System32\DRIVERS\GigasetGenericUSB.sys [44032 2012-11-08] (Siemens Home and Office Communication Devices GmbH & Co. KG)
R3 NETwNv32; C:\Windows\System32\DRIVERS\NETwNv32.sys [7346176 2011-10-31] (Intel Corporation)
R3 O2MDGRDR; C:\Windows\System32\DRIVERS\o2mdg.sys [51616 2009-01-08] (O2Micro )
R3 O2SDGRDR; C:\Windows\System32\DRIVERS\o2sdg.sys [41760 2009-01-08] (O2Micro )
R3 OEM13Vfx; C:\Windows\System32\DRIVERS\OEM13Vfx.sys [7424 2007-03-05] (EyePower Games Pte. Ltd.)
R3 OEM13Vid; C:\Windows\System32\DRIVERS\OEM13Vid.sys [235840 2008-05-28] (Creative Technology Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-19] (Avira GmbH)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [144384 2011-11-21] (1&1 Internet AG)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 17:11 - 2015-01-14 17:11 - 00016454 _____ () C:\Users\Rene\Downloads\FRST.txt
2015-01-14 17:11 - 2015-01-14 17:11 - 00000000 ____D () C:\FRST
2015-01-14 17:10 - 2015-01-14 17:10 - 00000470 _____ () C:\Users\Rene\Downloads\defogger_disable.log
2015-01-14 17:10 - 2015-01-14 17:10 - 00000000 _____ () C:\Users\Rene\defogger_reenable
2015-01-14 17:08 - 2015-01-14 17:08 - 00050477 _____ () C:\Users\Rene\Downloads\Defogger.exe
2015-01-14 17:06 - 2015-01-14 17:06 - 01115648 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2015-01-09 17:53 - 2015-01-09 17:53 - 00001783 _____ () C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2015-01-09 17:53 - 2014-10-13 06:57 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2015-01-09 17:53 - 2014-10-13 06:57 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2015-01-09 17:50 - 2015-01-09 17:50 - 00000000 ____D () C:\Users\Public\Documents\CrashDump
2015-01-09 17:42 - 2015-01-09 17:42 - 00000000 ____D () C:\Users\Rene\Documents\samsung
2015-01-09 17:42 - 2015-01-09 17:42 - 00000000 ____D () C:\Users\Public\Documents\NativeFus_Log
2015-01-09 17:40 - 2015-01-09 17:40 - 00000000 ____D () C:\Users\Mausi\AppData\Local\Sonos,_Inc
2015-01-06 17:36 - 2015-01-06 17:36 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Ashampoo
2015-01-06 17:35 - 2015-01-06 17:35 - 00000000 ____D () C:\Users\Rene\AppData\Local\ashampoo
2015-01-06 17:35 - 2015-01-06 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2015-01-06 17:35 - 2015-01-06 17:35 - 00000000 ____D () C:\ProgramData\Ashampoo
2015-01-06 17:35 - 2015-01-06 17:35 - 00000000 ____D () C:\Program Files\Ashampoo
2015-01-06 17:32 - 2015-01-06 17:32 - 01174352 _____ () C:\Users\Rene\Downloads\Vollversion Ashampoo Burning Studio 2014 - CHIP-Installer.exe
2015-01-04 00:47 - 2015-01-04 00:47 - 00000552 _____ () C:\Windows\PFRO.log
2015-01-03 14:06 - 2015-01-03 14:06 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\dvdcss
2015-01-03 10:20 - 2015-01-06 17:23 - 00000000 ____D () C:\Program Files\Exact Audio Copy
2015-01-03 10:20 - 2015-01-04 17:54 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\AccurateRip
2015-01-03 10:20 - 2015-01-03 10:20 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\EAC
2015-01-02 22:47 - 2015-01-02 22:48 - 00000044 _____ () C:\Users\Rene\Desktop\Neues Textdokument (2).txt
2015-01-02 15:31 - 2015-01-02 15:31 - 00000000 ____D () C:\Users\Rene\AppData\Local\Sonos,_Inc
2015-01-02 15:29 - 2015-01-13 17:21 - 00000000 ____D () C:\ProgramData\Sonos,_Inc
2015-01-02 15:29 - 2015-01-02 15:29 - 00001816 _____ () C:\Users\Public\Desktop\Sonos.lnk
2015-01-02 15:29 - 2015-01-02 15:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sonos
2015-01-02 15:29 - 2015-01-02 15:29 - 00000000 ____D () C:\Program Files\Sonos
2015-01-02 14:30 - 2015-01-02 14:30 - 00008224 _____ () C:\Users\sonos\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-02 14:30 - 2015-01-02 14:30 - 00000000 ____D () C:\Users\sonos\AppData\Roaming\Apple Computer
2015-01-02 14:29 - 2015-01-02 14:29 - 00000949 _____ () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-02 14:29 - 2015-01-02 14:29 - 00000944 _____ () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-01-02 14:29 - 2015-01-02 14:29 - 00000915 _____ () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2015-01-02 14:29 - 2015-01-02 14:29 - 00000020 ___SH () C:\Users\sonos\ntuser.ini
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\Startmenü
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\Netzwerkumgebung
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\Druckumgebung
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\Documents\Eigene Musik
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\Documents\Eigene Bilder
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 _SHDL () C:\Users\sonos\AppData\Local\Verlauf
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 ____D () C:\Users\sonos\AppData\Local\VirtualStore
2015-01-02 14:29 - 2015-01-02 14:29 - 00000000 ____D () C:\Users\sonos
2015-01-02 14:29 - 2012-09-15 08:48 - 00000000 ____D () C:\Users\sonos\AppData\Local\Microsoft Help
2015-01-02 14:29 - 2008-01-21 03:43 - 00000000 ___RD () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-01-02 14:29 - 2008-01-21 03:43 - 00000000 ___RD () C:\Users\sonos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-02 11:01 - 2015-01-10 10:57 - 00002644 _____ () C:\Windows\setupact.log
2015-01-02 11:01 - 2015-01-02 11:01 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-25 14:25 - 2015-01-02 20:26 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-12-24 20:13 - 2014-12-24 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-12-24 20:13 - 2014-12-24 20:13 - 00000000 ____D () C:\Program Files\QuickTime
2014-12-24 12:16 - 2014-12-24 12:16 - 00059464 _____ () C:\Users\Rene\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-24 12:15 - 2014-12-24 12:15 - 00271832 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-23 01:15 - 2014-12-23 01:15 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\WinRAR
2014-12-23 01:14 - 2014-12-23 01:14 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-23 01:14 - 2014-12-23 01:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-23 00:50 - 2014-12-23 00:51 - 00000000 ____D () C:\Program Files\Putty
2014-12-22 22:32 - 2014-12-24 12:07 - 00000000 ____D () C:\Program Files\FlexHEX
2014-12-22 17:39 - 2015-01-03 14:13 - 00000000 ____D () C:\TV
2014-12-22 17:12 - 2014-12-22 17:12 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Cliqz
2014-12-22 17:12 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll
2014-12-22 17:12 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll
2014-12-22 15:35 - 2014-12-22 15:35 - 02333824 _____ (Fastviewer.com) C:\Users\Rene\Downloads\fastclient_i_2914847.exe
2014-12-20 18:01 - 2015-01-14 16:40 - 02836860 _____ () C:\Windows\system32\http_ss.log
2014-12-20 18:01 - 2014-12-20 18:01 - 00000000 ____D () C:\Windows\system32\CSP

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-14 17:10 - 2012-09-14 19:27 - 00000000 ____D () C:\Users\Rene
2015-01-14 16:47 - 2012-09-15 09:36 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\Macromedia
2015-01-14 16:46 - 2014-03-03 13:41 - 01334307 _____ () C:\Windows\WindowsUpdate.log
2015-01-14 16:44 - 2006-11-02 11:33 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-14 16:40 - 2013-04-15 15:20 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-14 16:40 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-14 16:40 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-14 16:40 - 2006-11-02 13:47 - 00003712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-13 20:56 - 2006-11-02 14:01 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-13 17:13 - 2012-09-14 21:43 - 00021504 _____ () C:\Users\Mausi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-13 10:29 - 2012-11-03 13:25 - 00001495 _____ () C:\Users\Rene\Neues Textdokument.txt
2015-01-11 17:33 - 2012-09-15 11:25 - 00000000 ____D () C:\Users\Mausi\AppData\Roaming\Macromedia
2015-01-09 19:22 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-08 20:10 - 2012-09-14 19:27 - 00000680 _____ () C:\Users\Rene\AppData\Local\d3d9caps.dat
2015-01-06 04:36 - 2012-09-14 20:34 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-04 17:22 - 2012-10-05 11:46 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\vlc
2015-01-04 11:51 - 2012-10-05 12:52 - 00068608 _____ () C:\Users\Rene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-03 10:10 - 2013-01-15 18:37 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-01-02 15:29 - 2013-04-22 19:12 - 00000000 ____D () C:\Users\Rene\AppData\Local\Downloaded Installations
2015-01-02 13:17 - 2013-03-29 01:04 - 00000000 ____D () C:\TEMP
2015-01-01 15:49 - 2013-03-09 11:42 - 00000000 ____D () C:\Users\Rene\AppData\Roaming\FileZilla
2014-12-24 20:15 - 2013-12-25 13:01 - 00000000 ____D () C:\Users\Rene\AppData\Local\Apple Computer
2014-12-24 20:07 - 2012-09-14 19:27 - 00000944 _____ () C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-12-23 01:14 - 2012-09-29 14:34 - 00000000 ____D () C:\Program Files\WinRAR
2014-12-23 01:02 - 2013-04-01 23:07 - 00000600 _____ () C:\Users\Rene\AppData\Local\PUTTY.RND
2014-12-23 00:49 - 2013-08-06 18:12 - 00658619 _____ () C:\Program Files\PUTTY.HLP
2014-12-23 00:49 - 2013-08-06 18:12 - 00495616 _____ (Simon Tatham) C:\Program Files\PUTTY.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00448314 _____ () C:\Program Files\PUTTY.CHM
2014-12-23 00:49 - 2013-08-06 18:12 - 00335872 _____ (Simon Tatham) C:\Program Files\PSFTP.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00323584 _____ (Simon Tatham) C:\Program Files\PSCP.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00311296 _____ (Simon Tatham) C:\Program Files\PLINK.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00184320 _____ (Simon Tatham) C:\Program Files\PUTTYGEN.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00147456 _____ (Simon Tatham) C:\Program Files\PAGEANT.EXE
2014-12-23 00:49 - 2013-08-06 18:12 - 00032240 _____ () C:\Program Files\PUTTY.CNT
2014-12-22 20:04 - 2012-09-15 08:50 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-22 20:04 - 2012-09-15 08:50 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-20 18:14 - 2012-09-15 00:40 - 00000000 ____D () C:\Users\Mausi\AppData\Roaming\vlc
2014-12-20 18:00 - 2013-04-30 16:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2014-12-20 18:00 - 2013-04-22 19:22 - 00000000 ____D () C:\Program Files\Samsung
2014-12-20 18:00 - 2012-09-14 20:02 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-12-20 13:07 - 2013-03-09 11:31 - 00000000 ____D () C:\Users\Rene\AppData\Local\Thunderbird

Some content of TEMP:
====================
C:\Users\Mausi\AppData\Local\Temp\avgnt.exe
C:\Users\Rene\AppData\Local\Temp\avgnt.exe
C:\Users\sonos\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2015-01-14 16:46

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-01-2015 02
Ran by Rene at 2015-01-14 17:11:47
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 Upload-Manager (HKLM\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio 2014 v.12.0.5 (HKLM\...\{91B33C97-280F-B76D-E27B-E712D7041B76}_is1) (Version: 12.0.5 - Ashampoo GmbH & Co. KG)
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.06 - Piriform)
Cliqz (HKLM\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.53 - Cliqz.com)
Defraggler (HKLM\...\Defraggler) (Version: 2.17 - Piriform)
Dell 5530 Wireless Broadband Package (HKLM\...\{2DCEFEFF-7831-4D79-BC28-11D1B8D7E076}) (Version: 1.0.11.13 - Dell)
Dell Resource CD (HKLM\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.00.0000 - Ihr Firmenname)
FileZilla Client 3.9.0.5 (HKLM\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)
Gigaset QuickSync (HKLM\...\{17bce0e9-930e-4afb-8089-6863c562379c}) (Version: 8.1.0859.15652 - Gigaset Communications GmbH)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Hard Disk Low Level Format Tool 4.25 (HKLM\...\Hard Disk Low Level Format Tool_is1) (Version: - HDDGURU)
Hardcopy (HKLM\...\Hardcopy) (Version: 2013.02.18 - www.hardcopy.de)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6146.0 - IDT)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{C8005A7B-9638-41DD-B83B-AF277754E211}) (Version: 14.03.0000 - Intel Corporation)
iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 13 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217013FF}) (Version: 7.0.130 - Oracle)
Laptop Integrated Webcam Driver (1.01.01.0529) (HKLM\...\Creative OEM013) (Version: - )
Logitech Unifying-Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
MyFreeCodec (HKU\S-1-5-21-607557907-3096731163-2526116815-1000\...\MyFreeCodec) (Version: - )
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.4 - F.J. Wechselberger)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
O2Micro Flash Memory Card Windows Driver (HKLM\...\InstallShield_{348E6CDF-A6AE-45E6-B0AB-65A07B3C715E}) (Version: 2.0.03 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (Version: 2.0.03 - O2Micro International LTD.) Hidden
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge)
PSPad editor (HKLM\...\PSPad editor_is1) (Version: 4.5.7.2450 - Jan Fiala)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG PC Share Manager (HKLM\...\InstallShield_{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}) (Version: 2.3.0 - SAMSUNG)
SAMSUNG PC Share Manager (Version: 2.3.0 - SAMSUNG) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Sonos Controller (HKLM\...\{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}) (Version: 28.1.83040 - Sonos, Inc.)
System Requirements Lab for Intel (HKLM\...\{C71067FC-288F-4E0B-88C6-44DFDA8311E2}) (Version: 4.5.9.0 - Husdawg, LLC)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
WinSCP 5.5.1 (HKLM\...\winscp3_is1) (Version: 5.5.1 - Martin Prikryl)
Wise Registry Cleaner 7.84 (HKLM\...\Wise Registry Cleaner_is1) (Version: 7.84 - WiseCleaner.com, Inc.)
XnView 2.04 (HKLM\...\XnView_is1) (Version: 2.04 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\MSCOMCT2.OCX (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\MSCOMCT2.OCX (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{38911D8E-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{38911D90-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{38911D92-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\Windows\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\MSCOMCT2.OCX (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\Windows\system32\MSCOMCT2.OCX (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-607557907-3096731163-2526116815-1000_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\Windows\system32\MSCOMCT2.OCX (Microsoft Corporation)

==================== Restore Points =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2013-03-21 08:59 - 00000883 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.10 klp.test
127.0.0.10 www.klp.test
127.0.0.11 klp.test/priv
127.0.0.11 www.klp.test/priv


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {29E3185D-C25C-44AD-A86B-0DF66EE89950} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Mausi => C:\Program Files\Windows Calendar\wincal.exe [2009-04-10] (Microsoft Corporation)
Task: {3F916CF3-A0D2-4958-BAD3-F163EE7338F6} - System32\Tasks\hcdll2_ex_Win32 => C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe [2012-11-08] ()
Task: {6297F893-C2EE-459F-9EDC-21B5277ACA38} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {68B2B5F6-7549-4180-B6A3-110B1F35FD76} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {7480B665-DFF2-40F6-9478-3BB29E543C41} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {A4D292F6-51AE-4C39-BD7E-AAF912EB6B41} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {DCC860F8-7DC7-4BCA-9C78-EA76781EF9B7} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {E81BDFF2-C361-4EA3-A90D-DD9091C9A1A8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Loaded Modules (whitelisted) =============

2010-02-17 17:19 - 2010-02-17 17:19 - 03007488 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe
2009-01-07 20:01 - 2009-01-07 20:01 - 00649019 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\avformat-52.dll
2009-01-07 19:58 - 2009-01-07 19:58 - 00074795 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\avutil-49.dll
2009-01-07 20:01 - 2009-01-07 20:01 - 03989516 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\avcodec-52.dll
2009-04-15 10:40 - 2009-04-15 10:40 - 00057856 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\lang.dll
2009-02-13 13:29 - 2009-02-13 13:29 - 00409727 _____ () C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe
2013-03-09 12:28 - 2012-11-08 07:39 - 00037440 _____ () C:\Program Files\Hardcopy\hcdll2_ex_Win32.exe
2013-03-09 12:28 - 2012-07-05 14:56 - 00052800 _____ () C:\Program Files\Hardcopy\hardcopy_05.dll
2014-09-06 17:44 - 2014-09-06 17:44 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
2013-03-17 13:01 - 2009-11-16 20:31 - 00069632 _____ () C:\Program Files\PSPad editor\PSPadShell.dll
2014-12-12 11:14 - 2014-12-12 11:14 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: ROC_ROC_NT => "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT

========================= Accounts: ==========================

Administrator (S-1-5-21-607557907-3096731163-2526116815-500 - Administrator - Disabled)
Gast (S-1-5-21-607557907-3096731163-2526116815-501 - Limited - Disabled)
Mausi (S-1-5-21-607557907-3096731163-2526116815-1001 - Administrator - Enabled) => C:\Users\Mausi
Rene (S-1-5-21-607557907-3096731163-2526116815-1000 - Administrator - Enabled) => C:\Users\Rene
sonos (S-1-5-21-607557907-3096731163-2526116815-1005 - Limited - Enabled) => C:\Users\sonos
UpdatusUser (S-1-5-21-607557907-3096731163-2526116815-1004 - Limited - Disabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/14/2015 05:11:48 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422] ist ein Fehler aufgetreten.


Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen

Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator

Error: (01/14/2015 05:11:48 PM) (Source: VSS) (EventID: 40) (User: )
Description: Volumeschattenkopie-Dienst-Fehler: Der Dienst "Microsoft-Softwareschattenkopie-Anbieter" 
(SWPRV) ist deaktiviert. Aktivieren Sie den Dienst, und wiederholen Sie den Vorgang.


Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen

Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator

Error: (01/14/2015 04:40:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/13/2015 05:16:58 PM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Benachrichtigungen für Volume f:\ sind nicht aktiv. 

Kontext: Windows Anwendung


Details:
    Das Gerät ist nicht bereit. (0x80070015)

Error: (01/13/2015 02:47:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/13/2015 10:28:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/12/2015 02:13:14 PM) (Source: VSS) (EventID: 12292) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422] ist ein Fehler aufgetreten.


Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen

Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator

Error: (01/12/2015 02:13:14 PM) (Source: VSS) (EventID: 40) (User: )
Description: Volumeschattenkopie-Dienst-Fehler: Der Dienst "Microsoft-Softwareschattenkopie-Anbieter" 
(SWPRV) ist deaktiviert. Aktivieren Sie den Dienst, und wiederholen Sie den Vorgang.


Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen

Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator

Error: (01/12/2015 02:13:04 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (01/12/2015 02:13:03 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4


System errors:
=============
Error: (01/14/2015 04:42:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (01/14/2015 04:42:40 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1331

Error: (01/14/2015 04:41:23 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (01/14/2015 04:40:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (01/14/2015 04:40:26 PM) (Source: Print) (EventID: 19) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker An OneNote 2007 senden nicht unter dem Namen An OneNote 2007 senden freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.

Error: (01/14/2015 04:40:26 PM) (Source: Print) (EventID: 19) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker Canon Inkjet PIXMA iP4000 nicht unter dem Namen Canon Inkjet PIXMA iP4000 freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.

Error: (01/14/2015 04:40:26 PM) (Source: Print) (EventID: 19) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker PDF Architect nicht unter dem Namen PDF Architect freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.

Error: (01/14/2015 04:40:26 PM) (Source: Print) (EventID: 19) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker PDFCreator nicht unter dem Namen PDFCreator freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.

Error: (01/13/2015 02:48:46 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1001) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (01/13/2015 02:47:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058


Microsoft Office Sessions:
=========================
Error: (10/19/2014 09:57:39 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 2930 seconds with 1860 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2015-01-07 18:24:53.599
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 17:57:09.470
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 17:56:22.516
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-07 17:56:00.248
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 18:09:15.802
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 18:04:45.305
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 17:46:04.329
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 17:45:54.536
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 17:35:57.562
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2015-01-04 17:25:37.591
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\msiltcfg.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz
Percentage of memory in use: 52%
Total physical RAM: 3066.03 MB
Available physical RAM: 1460.26 MB
Total Pagefile: 6346.98 MB
Available Pagefile: 4425.04 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.57 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.66 GB) (Free:45.17 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:21.58 GB) (Free:20.29 GB) NTFS
Drive f: (Musik) (Fixed) (Total:931.48 GB) (Free:851.52 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 119.2 GB) (Disk ID: BAABF03E)
Partition 1: (Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=21.6 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: B80F288D)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-14 17:29:18
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_SSD_830_Series rev.CXM03B1Q 119,24GB
Running: gmer.exe; Driver: C:\Users\Rene\AppData\Local\Temp\uxldapow.sys


---- System - GMER 2.1 ----

SSDT 985A8EBE ZwCreateSection
SSDT 985A8EC8 ZwRequestWaitReplyPort
SSDT 985A8EC3 ZwSetContextThread
SSDT 985A8ECD ZwSetSecurityObject
SSDT 985A8ED2 ZwSystemDebugControl
SSDT 985A8E5F ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!KeSetEvent + 215 85CED860 4 Bytes [BE, 8E, 5A, 98]
.text ntkrnlpa.exe!KeSetEvent + 539 85CEDB84 4 Bytes [C8, 8E, 5A, 98] {ENTER 0x5a8e, 0x98}
.text ntkrnlpa.exe!KeSetEvent + 56D 85CEDBB8 4 Bytes [C3, 8E, 5A, 98] {RET ; MOV DS, [EDX-0x68]}
.text ntkrnlpa.exe!KeSetEvent + 5D1 85CEDC1C 4 Bytes [CD, 8E, 5A, 98] {INT 0x8e; POP EDX; CWDE }
.text ntkrnlpa.exe!KeSetEvent + 619 85CEDC64 4 Bytes [D2, 8E, 5A, 98]
.text ... 

---- User code sections - GMER 2.1 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!LdrLoadDll 77B19378 5 Bytes JMP 575C1F42 C:\Program Files\Mozilla Firefox\mozglue.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtCreateFile 77B54264 5 Bytes JMP 0F539870 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtFlushBuffersFile 77B54764 5 Bytes JMP 0F22D335 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtQueryFullAttributesFile 77B54C94 5 Bytes JMP 0F22D5B0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtReadFile 77B54EC4 5 Bytes JMP 0F22D390 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtReadFileScatter 77B54ED4 5 Bytes JMP 0FE98330 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtWriteFile 77B554D4 5 Bytes JMP 0F53A7F0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] ntdll.dll!NtWriteFileGather 77B554E4 5 Bytes JMP 0FE982DF C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] kernel32.dll!HeapSetInformation + 26 767EA9B8 7 Bytes JMP 0F536164 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] kernel32.dll!LockResource + C 76806BD3 7 Bytes JMP 0FDD9960 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] kernel32.dll!VirtualAllocEx + 54 7680B030 7 Bytes JMP 0FDD9983 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] USER32.dll!GetWindowInfo 77CB428E 5 Bytes JMP 0FCDB65E C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5780] GDI32.dll!SetStretchBltMode + 256 76EB745C 7 Bytes JMP 0FDD98E1 C:\Program Files\Mozilla Firefox\xul.dll

---- Registry - GMER 2.1 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9BEA6B67-D02A-0136-2F24-5EFD66BBE7A5} 
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Mausi\Downloads\aulauncher.exe 1

---- EOF - GMER 2.1 ----OTL Logfile:
         

OTL logfile created on: 14.01.2015 17:39:14 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Rene\Desktop\ScanTest
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 45,76% Memory free
6,20 Gb Paging File | 4,22 Gb Available in Paging File | 68,09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,66 Gb Total Space | 45,16 Gb Free Space | 46,24% Space Free | Partition Type: NTFS
Drive D: | 21,58 Gb Total Space | 20,29 Gb Free Space | 93,99% Space Free | Partition Type: NTFS
Drive F: | 931,48 Gb Total Space | 851,52 Gb Free Space | 91,42% Space Free | Partition Type: NTFS

Computer Name: LAPTOP | User Name: Rene | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Rene\Desktop\ScanTest\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe (DEVGURU Co., LTD.)
PRC - C:\Programme\PDF Architect\HelperService.exe (pdfforge GmbH)
PRC - C:\Programme\PDF Architect\ConversionService.exe (pdfforge GmbH)
PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Programme\Hardcopy\hcdll2_ex_Win32.exe ()
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe ()
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\System32\mmc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Programme\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe ()
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\OEM13Mon.exe (Creative Technology Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\316b149dbb031d0e35c9d57bb2fc4b6e\System.ServiceModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\92a3b88ac6300af062edd6503bc5903c\System.IdentityModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\38d6578b4fe29bede85ffff08e3697b6\PresentationFramework-SystemXml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\4df6733efc348c009a4a6e0adccc42a6\PresentationFramework-SystemData.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\446bc9f0c3b5824fab519cb5fec5af1b\WindowsFormsIntegration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\373a228baf04c2f9ad00fee73bf12ff8\MIGUIControls.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Managemen#\bbfc9f34523d8981ddd71254d725e5bb\Microsoft.ManagementConsole.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\MMCFxCommon\2e3bfcc871e7ecfaae8038ae51d286e4\MMCFxCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\TaskScheduler\d27243c6cfe533a7eb75df62ffd01f26\TaskScheduler.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\659052571b70d629c44140c9fd58f24d\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\57bed17a3ad0ad3bbe717287d4cb1625\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\a98a13deac020eca5e7dcb5ebb2b7414\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\a224433c0fb9281862f36823e86822fc\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f32d5986039f142f6e4f412de7c8901c\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\65897bde93bce2462330f19ef677477d\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\cf2c94955471d68d3708b1fbf613ae46\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\3646375313dd2b8e3afecbf945960336\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\006d28e7c86f3e70db90ce06ea2f33fb\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\8b133e0d94535a7534719f70873ca7fe\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\94bbd298ec8575f3c6151a59538a109c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\7971f3a1c08c4043cf981f457855b4d4\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\5d2c01ae1ca8c40ed74cdfd7b7b7dcb1\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\db563d596d76daed04e9b5d25b2f4cb9\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\902843918d037f5f3511d679bf1e2216\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\5e84979fadb7eb63caedea9f4acefcc9\System.Data.Linq.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b4c08872c259018b17b2801da33ac80f\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f9f13cd8fe1cefaad78579a7c3a41464\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\35d3a1b878542de59cb4fc0593992404\System.ServiceModel.Internals.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\046058f81b039ab6fd839e03e67595f8\SMDiagnostics.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\7147fa233a070283dba824da40089bf1\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\691c1ad89d16f49d80e84fa06a79089a\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\0648dbecb7e3fb9523565107e04a5caf\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\17a393b77ae757f0768501fb95ff5af6\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\6ccc2f167855025c161a81628c49f88f\Accessibility.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\3444fbefcbd532181c499150ace644a4\mscorlib.ni.dll ()
MOD - C:\Programme\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Programme\FileZilla FTP Client\libstdc++-6.dll ()
MOD - C:\Programme\FileZilla FTP Client\libgcc_s_sjlj-1.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\75b6a68103e1b76063d9f69b8275ae61\UIAutomationTypes.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\ce5f61c5754789df97be8dc991c47d07\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\4c8a153aa66fcd62db6fff269a2ef2b4\System.Numerics.ni.dll ()
MOD - C:\Programme\Hardcopy\hcdll2_ex_Win32.exe ()
MOD - C:\Programme\Hardcopy\hardcopy_05.dll ()
MOD - C:\Programme\PSPad editor\PSPadShell.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\TaskScheduler.resources\6.0.0.0_de_31bf3856ad364e35\TaskScheduler.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MIGUIControls.resources\1.0.0.0_de_31bf3856ad364e35\MIGUIControls.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MMCEx.resources\3.0.0.0_de_31bf3856ad364e35\MMCEx.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\EventViewer.resources\6.0.0.0_de_31bf3856ad364e35\EventViewer.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\MMCEx.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\EventViewer\6.0.0.0__31bf3856ad364e35\EventViewer.dll ()


========== Services (SafeList) ==========

SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Avira.OE.ServiceHost) -- C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG)
SRV - (ss_conn_service) -- C:\Programme\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe (DEVGURU Co., LTD.)
SRV - (PDF Architect Helper Service) -- C:\Programme\PDF Architect\HelperService.exe (pdfforge GmbH)
SRV - (PDF Architect Service) -- C:\Programme\PDF Architect\ConversionService.exe (pdfforge GmbH)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (WiselinkPro) -- C:\Programme\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe ()
SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ec3a90dd\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (O2FLASH) -- C:\Windows\System32\drivers\o2flash.exe (O2Micro International)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (VMnetAdapter) -- system32\DRIVERS\vmnetadapter.sys File not found
DRV - (vmci) -- C:\Windows\system32\DRIVERS\vmci.sys File not found
DRV - (uxldapow) -- C:\Users\Rene\AppData\Local\Temp\uxldapow.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (ssudmdm) -- C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) -- C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek )
DRV - (GigasetGenericUSB) -- C:\Windows\System32\drivers\GigasetGenericUSB.sys (Siemens Home and Office Communication Devices GmbH & Co. KG)
DRV - (ui11rdr) -- C:\Windows\System32\drivers\ui11rdr.SYS (1&1 Internet AG)
DRV - (NETwNv32) -- C:\Windows\System32\drivers\NETwNv32.sys (Intel Corporation)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (O2MDGRDR) -- C:\Windows\System32\drivers\o2mdg.sys (O2Micro )
DRV - (O2SDGRDR) -- C:\Windows\System32\drivers\o2sdg.sys (O2Micro )
DRV - (NETw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (OEM13Vid) -- C:\Windows\System32\drivers\OEM13Vid.sys (Creative Technology Ltd.)
DRV - (OEM13Vfx) -- C:\Windows\System32\drivers\OEM13Vfx.sys (EyePower Games Pte. Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=frg0203ff&cd=2XzuyEtN2Y1L1QzutDtDtByE0Ezz0CyByE0AtCyCyD0EyB0DtN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyDtC0Azz0Ezz0DyCtGyD0EtByCtGzyyDyC0EtG0C0FtDyDtGtA0ByDyEyDtCtAyE0AzzyDzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzy0DzyyBzztB0FtG0EzyyC0FtG0F0F0E0FtGyD0Dzz0DtGtD0F0BtAzyzyyB0DyE0BtB0D2Q&cr=1045373360&ir=
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\SearchScopes\{33745073-C737-430A-B7AD-FAEDC71F7BE4}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=57625cf3-00c5-4178-8daa-c878a132d507&apn_sauid=6EB329DB-D8A4-4427-8D89-46AD85421FA3
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = https://isearch.avg.com/search?cid={C9426FFE-6C04-40C1-88D4-C620ED72552C}&mid=07e5d0453a0847d0b6c1d16dae23a3e5-88bea68513c636428419fdaca391f6dc89374e68&lang=de&ds=pd011&pr=sa&d=2012-09-21 16:37:38&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=frg0203ff&cd=2XzuyEtN2Y1L1QzutDtDtByE0Ezz0CyByE0AtCyCyD0EyB0DtN0D0Tzu0SyBzytAtN1L2XzutBtFtCyBtFtDtFtCtN1L1CzutDzytDtCtG1TtN1L1G1B1V1N2Y1L1Qzu2SyDtC0Azz0Ezz0DyCtGyD0EtByCtGzyyDyC0EtG0C0FtDyDtGtA0ByDyEyDtCtAyE0AzzyDzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzy0DzyyBzztB0FtG0EzyyC0FtG0F0F0E0FtGyD0Dzz0DtGtD0F0BtAzyzyyB0DyE0BtB0D2Q&cr=1045373360&ir=
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.order.1: "Mysearchdial"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7Be968fc70-8f95-4ab9-9e79-304de2a71ee1%7D:0.7.3
FF - prefs.js..extensions.enabledAddons: %7B455D905A-D37C-4643-A9E2-F6FEFAA0424A%7D:0.8.17
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.9.10
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:34.0.5
FF - prefs.js..keyword.URL: ""
FF - prefs.js..network.proxy.http: "118.98.172.187"
FF - prefs.js..network.proxy.http_port: 31280


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.05.19 10:18:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 31.3.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 31.3.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\cliqz@cliqz.com: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\dbfhjvt4.default\extensions\cliqz@cliqz.com
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 31.3.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 31.3.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2012.09.14 20:12:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\Extensions
[2015.01.01 15:56:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\Firefox\Profiles\dbfhjvt4.default\extensions
[2014.12.12 12:06:24 | 000,000,000 | ---D | M] (Avira Browser Safety) -- C:\Users\Rene\AppData\Roaming\mozilla\Firefox\Profiles\dbfhjvt4.default\extensions\abs@avira.com
[2014.12.23 13:09:29 | 001,188,646 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\cliqz@cliqz.com.xpi
[2014.12.12 12:29:45 | 000,065,568 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}.xpi
[2015.01.01 15:56:59 | 000,544,302 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2014.11.15 06:26:04 | 000,979,699 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.09.15 09:54:59 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2013.01.26 15:45:57 | 000,042,336 | ---- | M] () (No name found) -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
[2013.04.01 11:57:30 | 000,002,333 | ---- | M] () -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\searchplugins\askcom.xml
[2014.03.22 14:48:57 | 000,000,971 | ---- | M] () -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\searchplugins\avira-safesearch.xml
[2014.12.22 20:42:11 | 000,000,663 | ---- | M] () -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\searchplugins\google-images.xml
[2014.12.22 20:42:11 | 000,002,307 | ---- | M] () -- C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\dbfhjvt4.default\searchplugins\google-maps.xml
[2014.12.12 11:14:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2014.12.12 11:14:28 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2013.03.21 08:59:53 | 000,000,883 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.10 ccc.test
O1 - Hosts: 127.0.0.10 www.ccc.test
O1 - Hosts: 127.0.0.11 ccc.test/priv
O1 - Hosts: 127.0.0.11 www.ccc.test/priv
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Programme\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Programme\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Avira Systray] C:\Programme\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [OEM13Mon.exe] C:\Windows\OEM13Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-607557907-3096731163-2526116815-1000..\Run: [1&1_1&1 Upload-Manager] C:\Program Files\1&1\1&1 Upload-Manager\DAVSRV.EXE (1&1 Internet AG)
O4 - HKU\S-1-5-21-607557907-3096731163-2526116815-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Mausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E-Mail - Verknüpfung.lnk = File not found
O4 - Startup: C:\Users\Mausi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Internet - Verknüpfung.lnk = File not found
O7 - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = DD 00 00 00 [binary data]
O7 - HKU\S-1-5-21-607557907-3096731163-2526116815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.11.12.13
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1331BCE8-9E89-4B84-967F-B5F581FB9906}: DhcpNameServer = 10.11.12.13
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B3714FC-C27C-44C3-8300-574815DBDACC}: NameServer = 10.11.12.13
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2015.01.14 17:12:51 | 000,000,000 | ---D | C] -- C:\Users\Rene\Desktop\ScanTest
[2015.01.14 17:11:12 | 000,000,000 | ---D | C] -- C:\FRST
[2015.01.09 17:53:05 | 000,184,192 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\System32\drivers\ssudmdm.sys
[2015.01.09 17:53:05 | 000,089,856 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\System32\drivers\ssudbus.sys
[2015.01.09 17:50:45 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2015.01.09 17:42:53 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2015.01.09 17:42:48 | 000,000,000 | ---D | C] -- C:\Users\Rene\Documents\samsung
[2015.01.06 17:36:03 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\Ashampoo
[2015.01.06 17:35:57 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Local\ashampoo
[2015.01.06 17:35:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2015.01.06 17:35:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Ashampoo
[2015.01.06 17:35:16 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2015.01.03 14:06:12 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\dvdcss
[2015.01.03 10:20:29 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\EAC
[2015.01.03 10:20:24 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\AccurateRip
[2015.01.03 10:20:19 | 000,000,000 | ---D | C] -- C:\Program Files\Exact Audio Copy
[2015.01.02 15:31:49 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Local\Sonos,_Inc
[2015.01.02 15:29:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sonos
[2015.01.02 15:29:24 | 000,000,000 | ---D | C] -- C:\Program Files\Sonos
[2015.01.02 15:29:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Sonos,_Inc
[2014.12.25 14:25:19 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2014.12.24 20:13:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2014.12.24 20:13:38 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2014.12.23 01:15:34 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\WinRAR
[2014.12.23 01:14:29 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014.12.23 01:14:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014.12.23 00:50:53 | 000,000,000 | ---D | C] -- C:\Program Files\Putty
[2014.12.22 22:32:03 | 000,000,000 | ---D | C] -- C:\Program Files\FlexHEX
[2014.12.22 17:39:43 | 000,000,000 | ---D | C] -- C:\TV
[2014.12.22 17:12:12 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\System32\dhRichClient3.dll
[2014.12.22 17:12:12 | 000,000,000 | ---D | C] -- C:\Users\Rene\AppData\Roaming\Cliqz
[2014.12.20 18:01:08 | 000,000,000 | ---D | C] -- C:\Windows\System32\CSP
[2013.08.06 18:12:44 | 000,495,616 | ---- | C] (Simon Tatham) -- C:\Program Files\PUTTY.EXE
[2013.08.06 18:12:44 | 000,335,872 | ---- | C] (Simon Tatham) -- C:\Program Files\PSFTP.EXE
[2013.08.06 18:12:44 | 000,323,584 | ---- | C] (Simon Tatham) -- C:\Program Files\PSCP.EXE
[2013.08.06 18:12:44 | 000,311,296 | ---- | C] (Simon Tatham) -- C:\Program Files\PLINK.EXE
[2013.08.06 18:12:44 | 000,184,320 | ---- | C] (Simon Tatham) -- C:\Program Files\PUTTYGEN.EXE
[2013.08.06 18:12:44 | 000,147,456 | ---- | C] (Simon Tatham) -- C:\Program Files\PAGEANT.EXE

========== Files - Modified Within 30 Days ==========

[2015.01.14 17:10:28 | 000,000,000 | ---- | M] () -- C:\Users\Rene\defogger_reenable
[2015.01.14 16:44:51 | 000,674,274 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2015.01.14 16:44:51 | 000,634,484 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2015.01.14 16:44:51 | 000,146,254 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2015.01.14 16:44:51 | 000,120,050 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2015.01.14 16:40:30 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2015.01.14 16:40:30 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2015.01.14 16:40:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015.01.14 16:40:15 | 3215,937,536 | -HS- | M] () -- C:\hiberfil.sys
[2015.01.09 18:06:54 | 003,546,595 | ---- | M] () -- C:\Users\Rene\Documents\IMG-20141231-WA0008.jpg
[2015.01.09 17:53:22 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
[2015.01.08 20:10:35 | 000,000,680 | ---- | M] () -- C:\Users\Rene\AppData\Local\d3d9caps.dat
[2015.01.06 04:36:02 | 000,249,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2015.01.04 11:51:55 | 000,068,608 | ---- | M] () -- C:\Users\Rene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2015.01.02 15:29:25 | 000,001,816 | ---- | M] () -- C:\Users\Public\Desktop\Sonos.lnk
[2014.12.24 12:15:57 | 000,271,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2014.12.23 01:02:14 | 000,000,600 | ---- | M] () -- C:\Users\Rene\AppData\Local\PUTTY.RND
[2014.12.23 00:49:05 | 000,448,314 | ---- | M] () -- C:\Program Files\PUTTY.CHM
[2014.12.23 00:49:04 | 000,184,320 | ---- | M] (Simon Tatham) -- C:\Program Files\PUTTYGEN.EXE
[2014.12.23 00:49:03 | 000,495,616 | ---- | M] (Simon Tatham) -- C:\Program Files\PUTTY.EXE
[2014.12.23 00:49:02 | 000,335,872 | ---- | M] (Simon Tatham) -- C:\Program Files\PSFTP.EXE
[2014.12.23 00:49:02 | 000,323,584 | ---- | M] (Simon Tatham) -- C:\Program Files\PSCP.EXE
[2014.12.23 00:49:02 | 000,311,296 | ---- | M] (Simon Tatham) -- C:\Program Files\PLINK.EXE
[2014.12.23 00:49:02 | 000,147,456 | ---- | M] (Simon Tatham) -- C:\Program Files\PAGEANT.EXE
[2014.12.22 20:04:43 | 000,701,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2014.12.22 20:04:43 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2015.01.14 17:10:28 | 000,000,000 | ---- | C] () -- C:\Users\Rene\defogger_reenable
[2015.01.09 18:06:54 | 003,546,595 | ---- | C] () -- C:\Users\Rene\Documents\IMG-20141231-WA0008.jpg
[2015.01.09 17:53:22 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
[2015.01.02 15:29:25 | 000,001,816 | ---- | C] () -- C:\Users\Public\Desktop\Sonos.lnk
[2014.12.24 12:15:50 | 000,271,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2014.12.22 17:12:13 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2014.10.10 14:42:39 | 000,039,146 | ---- | C] () -- C:\Users\Rene\AppData\Local\recently-used.xbel
[2014.09.03 19:58:36 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2014.03.03 14:51:04 | 000,000,600 | ---- | C] () -- C:\Users\Rene\AppData\Roaming\winscp.rnd
[2014.03.03 14:06:04 | 000,000,068 | ---- | C] () -- C:\Users\Rene\AppData\Roaming\WB.CFG
[2013.08.06 18:12:44 | 000,448,314 | ---- | C] () -- C:\Program Files\PUTTY.CHM
[2013.04.30 16:16:41 | 008,091,088 | ---- | C] () -- C:\Users\Rene\GT-P5110_UM_Open_Icecream_Ger_Rev.1.0_120612_Screen.pdf
[2013.04.01 23:07:05 | 000,000,600 | ---- | C] () -- C:\Users\Rene\AppData\Local\PUTTY.RND
[2013.03.19 14:23:14 | 000,001,006 | ---- | C] () -- C:\Users\Rene\hosts.neu
[2013.03.19 10:36:37 | 000,000,000 | ---- | C] () -- C:\Users\Rene\mysql
[2012.11.24 11:27:54 | 000,017,408 | ---- | C] () -- C:\Users\Rene\AppData\Local\WebpageIcons.db
[2012.10.05 12:52:45 | 000,068,608 | ---- | C] () -- C:\Users\Rene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.14 19:27:05 | 000,000,680 | ---- | C] () -- C:\Users\Rene\AppData\Local\d3d9caps.dat

========== ZeroAccess Check ==========

[2013.08.04 13:46:36 | 000,003,381 | ---- | M] () -- C:\$Recycle.bin\S-1-5-21-607557907-3096731163-2526116815-1000\$RAL477R\gifs\n.gif
[2006.11.02 13:54:18 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014.03.25 14:26:04 | 011,587,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 22:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >