Bei fast jedem Klick geht eine neue Seite mit Werbung auf

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:51 on 20/01/2015 (Astrid )

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015
Ran by Astrid  (administrator) on ASTRID on 20-01-2015 16:53:46
Running from C:\Users\Astrid \Downloads
Loaded Profiles: Astrid  (Available profiles: Astrid )
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
() C:\QuickStartUtil\VAWinService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
() C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe
() C:\QuickStartUtil\VAWinAgent.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Buyond GmbH) C:\Program Files (x86)\Buyond_GmbH\GloboFleet_CC\GloboFleet_CC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Spotify Ltd) C:\Users\Astrid Böttcher\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
() C:\Users\Astrid Böttcher\Downloads\Defogger (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\btvstack.exe [1022592 2012-04-28] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\athbttray.exe [801920 2012-04-28] (Atheros Commnucations)
HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-08-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2012-08-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-08-21] (Lenovo)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [329624 2012-06-22] ( )
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2012-01-26] (Lenovo, Inc.)
HKLM-x32\...\Run: [Intelligent Touchpad] => C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe [291272 2011-12-08] ()
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [VAWinAgent] => C:\QuickStartUtil\VAWinAgent.exe [45480 2012-06-04] ()
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-08-21] (Lenovo)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [GloboFleet CC] => C:\Program Files (x86)\Buyond_GmbH\GloboFleet_CC\GloboFleet_CC.exe [235328 2013-08-08] (Buyond GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-08-21] (Google Inc.)
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [Spotify] => C:\Users\Astrid Böttcher\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-17] (Spotify Ltd)
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Run: [Spotify Web Helper] => C:\Users\Astrid Böttcher\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-17] (Spotify Ltd)
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\MountPoints2: {38f5e2a6-0ff5-11e4-9569-74e543fb024d} - E:\AutoRun.exe
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\MountPoints2: {5a958444-3809-11e3-b04d-74e543fb024d} - E:\AutoRun.exe
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\MountPoints2: {8ba0c14b-3737-11e3-89a8-74e543fb024d} - E:\AutoRun.exe
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\MountPoints2: {8ba0c164-3737-11e3-89a8-74e543fb024d} - E:\AutoRun.exe
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse] => "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] => "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"
Startup: C:\Users\Astrid Böttcher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} =>  No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} =>  No File
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3392072093-3665888848-192803557-1000] => http=127.0.0.1:60350;https=127.0.0.1:60350
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\S-1-5-21-3392072093-3665888848-192803557-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE537
SearchScopes: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE537
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-3392072093-3665888848-192803557-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.188.1
Tcpip\..\Interfaces\{0A6F295B-354E-441C-9445-C5444681D645}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{75E76526-9C40-4A25-A1DB-649B8E2A3BFC}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{C2A62BED-086A-4DC6-AB12-3938572A2CCB}: [NameServer] 193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{CF5D4A81-BF43-4D86-AD28-45A03D6C1711}: [NameServer] 81.218.119.15,199.203.35.75

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [7go@7go.com] - C:\Users\Astrid\AppData\Roaming\Mozilla\Extensions\7go@7go.com
FF Extension: 7Go Games - C:\Users\Astrid \AppData\Roaming\Mozilla\Extensions\7go@7go.com [2013-09-16]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Firefox\Extensions: [7go@7go.com] - C:\Users\Astrid \AppData\Roaming\Mozilla\Extensions\7go@7go.com

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108
CHR StartupUrls: Default -> "hxxp://www.mystart.com/?pr=vmn&id=mystarttb&v=5_4&ent=hp_5108&src=5108", "hxxp://www.google.de/"
CHR Profile: C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-17]
CHR Extension: (Google Drive) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-17]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Astrid Böttcher\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (YouTube) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-17]
CHR Extension: (Google-Suche) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-17]
CHR Extension: (AdBlock) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-15]
CHR Extension: (appbarioDE) - C:\Users\Astrid Böttcher\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf [2014-01-13]
CHR Extension: (Google Wallet) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-17]
CHR Extension: (Google Mail) - C:\Users\Astrid \AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-17]
CHR HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Astrid Böttcher\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [2013-08-28]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Astrid Böttcher\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [2013-08-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S2 BootShieldSvc; C:\Windows\System32\BootShieldSvc.exe [123952 2012-02-06] (Lenovo)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
R2 LenovoSmartConnectService; C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe [66608 2012-02-20] (Lenovo)
R2 Lexware_Update_Service; C:\Program Files (x86)\Lexware\Update Service\Hmg.InstallationService.Service.exe [61992 2014-02-18] (Haufe-Lexware GmbH & Co. KG)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2013-10-17] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2102072 2013-12-18] (AVG)
R2 VideAceWindowsService; C:\QuickStartUtil\VAWinService.exe [91464 2011-03-25] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [163456 2012-04-28] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
R0 BootShield; C:\Windows\System32\drivers\BootShield.sys [31536 2012-04-16] (Lenovo Corporation")
R1 BootShieldfltr; C:\Windows\System32\drivers\BootShieldfltr.sys [61744 2012-02-16] (Lenovo Corporation)
R3 cxbu0x64; C:\Windows\System32\DRIVERS\cxbu0x64.sys [191224 2014-04-05] (HID Global Corporation)
R3 LAD; C:\Windows\System32\DRIVERS\LAD.sys [8192 2012-01-12] (TODO: <Company name>)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-20] (Malwarebytes Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27960 2012-07-13] (Synaptics Incorporated)
S3 TTHID; C:\Windows\System32\DRIVERS\Cinergy_Hybrid-Stick_HID.sys [27944 2012-09-27] (DTV-DVB)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2013-12-16] (TuneUp Software)
S3 UDXTTM6010; C:\Windows\System32\DRIVERS\UDXTTM6010.sys [841384 2012-09-27] ()
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc; No ImagePath
S1 BdfNdisf; \??\c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [X]
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
U2 DriverService; No ImagePath
U2 iATAgentService; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
U2 Oasis2Service; No ImagePath
U2 PCCarerService; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SeaPort; No ImagePath
U2 SoftwareService; No ImagePath
U3 SQLWriter; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-20 16:53 - 2015-01-20 16:54 - 00026353 _____ () C:\Users\Astrid \Downloads\FRST.txt
2015-01-20 16:53 - 2015-01-20 16:53 - 00000000 ____D () C:\FRST
2015-01-20 16:52 - 2015-01-20 16:52 - 02126848 _____ (Farbar) C:\Users\Astrid \Downloads\FRST64.exe
2015-01-20 16:50 - 2015-01-20 16:50 - 00050477 _____ () C:\Users\Astrid \Downloads\Defogger (1).exe
2015-01-20 16:37 - 2015-01-20 16:51 - 00000492 _____ () C:\Users\Astrid \Downloads\defogger_disable.log
2015-01-20 16:37 - 2015-01-20 16:37 - 00000000 _____ () C:\Users\Astrid \defogger_reenable
2015-01-20 16:36 - 2015-01-20 16:36 - 00050477 _____ () C:\Users\Astrid \Downloads\Defogger.exe
2015-01-20 15:08 - 2015-01-20 15:09 - 02186752 _____ () C:\Users\Astrid \Downloads\adwcleaner_4.108.exe
2015-01-14 10:06 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 10:06 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 10:06 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 10:06 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 10:06 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 10:06 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 10:05 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 10:05 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 10:05 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 10:05 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 10:05 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 10:05 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 10:05 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-12 11:36 - 2015-01-09 13:20 - 00017770 _____ () C:\Users\Astrid \Documents\Ohne%20Mwst%204.%20Quartal%202014.xls_0.ods
2015-01-12 11:36 - 2015-01-09 13:00 - 00023337 _____ () C:\Users\Astrid \Documents\4.%20Quartal%202014.xls_0.ods
2015-01-12 11:36 - 2015-01-08 21:19 - 00017217 _____ () C:\Users\Astrid \Documents\Essensplan%202015.xls_1.ods
2015-01-08 17:02 - 2015-01-08 17:02 - 00083456 _____ () C:\Users\Astrid \Downloads\Polen Reiseeinzelheiten IV Quartal 2014- UMSATZSTEUER Polen.xls
2014-12-28 19:04 - 2015-01-20 08:14 - 00010240 _____ () C:\Users\Astrid \Desktop\Essensplan 2015.xls
2014-12-28 17:08 - 2014-12-30 17:43 - 00015872 _____ () C:\Users\Astrid \Desktop\Essensplan2014.xls
2014-12-28 14:03 - 2014-12-28 14:03 - 16766700 _____ (Adobe Systems Incorporated) C:\Users\Astrid Böttcher\Downloads\hauptantrag.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-20 16:46 - 2014-07-18 10:18 - 00000000 ____D () C:\Users\Astrid \Desktop\Handybilder Vladi
2015-01-20 16:44 - 2014-04-23 12:37 - 00000000 ____D () C:\Users\Astrid \AppData\Roaming\Spotify
2015-01-20 16:43 - 2014-09-02 20:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-20 16:43 - 2014-09-02 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-20 16:43 - 2014-09-02 20:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-20 16:37 - 2013-09-05 07:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-20 16:37 - 2013-05-21 09:30 - 00000000 ____D () C:\Users\Astrid 
2015-01-20 16:35 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-20 16:35 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-20 16:17 - 2012-08-21 06:56 - 01694842 _____ () C:\Windows\WindowsUpdate.log
2015-01-20 16:13 - 2014-01-29 13:07 - 00000000 ___RD () C:\Users\Astrid \Dropbox
2015-01-20 16:13 - 2014-01-29 13:06 - 00000000 ____D () C:\Users\Astrid \AppData\Roaming\Dropbox
2015-01-20 16:11 - 2012-08-21 08:06 - 00669829 _____ () C:\Windows\system32\fastboot.set
2015-01-20 16:11 - 2012-08-21 07:57 - 00000000 ____D () C:\ProgramData\VeriFace
2015-01-20 16:10 - 2013-05-21 09:30 - 03178577 _____ () C:\FaceProv.log
2015-01-20 16:10 - 2012-08-21 07:58 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-20 16:09 - 2010-11-21 04:47 - 01063504 _____ () C:\Windows\PFRO.log
2015-01-20 16:09 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-20 16:09 - 2009-07-14 05:51 - 00133001 _____ () C:\Windows\setupact.log
2015-01-20 16:08 - 2014-02-17 11:57 - 00000000 ____D () C:\AdwCleaner
2015-01-20 15:58 - 2012-08-21 07:58 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-20 15:52 - 2014-12-10 12:06 - 00011264 _____ () C:\Users\Astrid \Desktop\Aktuell offene Rechnungen.xls
2015-01-19 11:29 - 2014-08-28 10:22 - 00000000 ____D () C:\Users\Astrid \AppData\Local\Windows Live
2015-01-18 12:41 - 2014-02-17 14:15 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-16 14:10 - 2012-08-21 16:34 - 00714910 _____ () C:\Windows\system32\perfh007.dat
2015-01-16 14:10 - 2012-08-21 16:34 - 00154704 _____ () C:\Windows\system32\perfc007.dat
2015-01-16 14:10 - 2009-07-14 06:13 - 01651208 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-14 22:34 - 2013-10-23 06:12 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 22:23 - 2013-10-23 06:12 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 11:37 - 2013-09-05 07:49 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-14 11:37 - 2013-09-05 07:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 11:37 - 2013-09-05 07:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-10 20:05 - 2013-05-21 09:33 - 00124184 _____ () C:\Users\Astrid \AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-10 20:03 - 2009-07-14 05:45 - 00479480 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-08 13:46 - 2013-06-03 13:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-08 13:46 - 2013-05-22 14:39 - 00000000 ____D () C:\Users\Astrid \AppData\Local\CrashDumps
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-12-28 14:17 - 2014-10-20 16:56 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

==================== Files in the root of some directories =======
2014-08-22 08:50 - 2014-08-22 08:50 - 0033193 _____ () C:\Users\Astrid \AppData\Roaming\UserTile.png
2014-01-13 13:52 - 2014-09-02 09:18 - 0000264 _____ () C:\Users\Astrid \AppData\Roaming\WB.CFG
2014-01-13 13:52 - 2014-01-31 07:36 - 0000005 _____ () C:\Users\Astrid \AppData\Roaming\WBPU-TTL.DAT
2014-11-24 19:00 - 2014-11-24 19:00 - 0003584 _____ () C:\Users\Astrid \AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-02 10:42 - 2014-09-02 10:42 - 0631728 _____ () C:\Users\Astrid \AppData\Local\nsk6922.tmp
2014-03-24 09:31 - 2014-03-24 09:40 - 0135932 _____ () C:\ProgramData\1395649919.1768.bin
2014-03-24 09:32 - 2014-03-24 09:32 - 0002969 _____ () C:\ProgramData\1395649919.3340.bin
2014-03-24 09:32 - 2014-03-24 09:40 - 0205400 _____ () C:\ProgramData\1395649919.3372.bin
2014-03-24 09:32 - 2014-03-24 09:36 - 0017164 _____ () C:\ProgramData\1395649919.3904.bin
2014-03-24 09:32 - 2014-03-24 09:32 - 0017887 _____ () C:\ProgramData\1395649919.3976.bin
2014-03-24 09:36 - 2014-03-24 09:36 - 0002247 _____ () C:\ProgramData\1395649919.4524.bin
2014-03-24 09:32 - 2014-03-24 09:34 - 0001545 _____ () C:\ProgramData\1395649919.4556.bin
2014-03-24 09:32 - 2014-03-24 09:40 - 0075842 _____ () C:\ProgramData\1395649919.4988.bin
2014-03-24 09:32 - 2014-03-24 09:32 - 0009466 _____ () C:\ProgramData\1395649919.5884.bin
2014-03-24 09:32 - 2014-03-24 09:32 - 0001090 _____ () C:\ProgramData\1395649919.6092.bin
2014-03-24 09:32 - 2014-03-24 09:32 - 0001090 _____ () C:\ProgramData\1395649919.6620.bin
2014-03-24 09:32 - 2014-03-24 09:40 - 0047226 _____ () C:\ProgramData\1395649919.7336.bin
2014-09-04 12:37 - 2014-09-04 12:37 - 0492542 _____ () C:\ProgramData\1409830434.bdinstall.bin
2014-11-19 10:11 - 2014-11-19 10:11 - 0248150 _____ () C:\ProgramData\1416388167.bdinstall.bin
2012-08-21 08:07 - 2012-08-21 08:07 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Astrid \AppData\Local\Temp\APNSetup.exe
C:\Users\Astrid \AppData\Local\Temp\AskSLib.dll
C:\Users\Astrid \AppData\Local\Temp\avgnt.exe
C:\Users\Astrid \AppData\Local\Temp\BackupSetup.exe
C:\Users\Astrid \AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7ewslq.dll
C:\Users\Astrid \AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Astrid \AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Astrid \AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Astrid \AppData\Local\Temp\Quarantine.exe
C:\Users\Astrid \AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Astrid \AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Astrid \AppData\Local\Temp\setup_337.exe
C:\Users\Astrid \AppData\Local\Temp\SHSetup.exe
C:\Users\Astrid \AppData\Local\Temp\sqlite3.dll
C:\Users\Astrid \AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Astrid \AppData\Local\Temp\tbappb.dll
C:\Users\Astrid \AppData\Local\Temp\TUUUninstallHelper.exe
C:\Users\Astrid \AppData\Local\Temp\uninst1.exe
C:\Users\Astrid \AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-06 09:26

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015
Ran by Astrid at 2015-01-20 16:55:55
Running from C:\Users\Astrid \Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.0.0.17 - Absolute Software)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{1AAB4E7F-4704-3EE4-D284-14CD1B170580}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.135 - Atheros)
Atheros WLAN Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
ATI Uninstaller (HKLM\...\ATI Uninstaller) (Version: 8.933.3.4-120305a-139851C-Lenovo - Advanced Micro Devices, Inc.)
AVG PC TuneUp 2014 (de-DE) (x32 Version: 14.0.1001.295 - AVG) Hidden
AVG PC TuneUp 2014 (HKLM-x32\...\AVG PC TuneUp) (Version: 14.0.1001.295 - AVG)
AVG PC TuneUp 2014 (x32 Version: 14.0.1001.295 - AVG) Hidden
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
BootShield (HKLM-x32\...\{4677B88C-CE16-4CBB-A2CB-B76E9D456C7F}) (Version: 1.0.1.9 - Lenovo)
Brother MFL-Pro Suite MFC-7840W (HKLM-x32\...\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Cinergy Hybrid Stick V1.00.08.06a (HKLM-x32\...\Cinergy Hybrid Stick) (Version: 1.00.08.06a - )
Content Manager 2 (HKLM-x32\...\Content Manager 2) (Version: 3.18.0.342250 - NNG Llc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
dakota.ag (x32 Version: 6.0 - ITSG GmbH) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.13 - Dolby Laboratories Inc)
Dropbox (HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.1.13904 - Landesfinanzdirektion Thüringen)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.4.1 - Lenovo)
Energy Management (x32 Version: 7.0.4.1 - Lenovo) Hidden
Foxtab (HKLM-x32\...\foxtab) (Version:  - FoxTab) <==== ATTENTION!
FoxTab (HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\FoxTab) (Version:  - FoxTab) <==== ATTENTION!
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
GloboFleet CC (HKLM-x32\...\{59A56988-9AC7-43FD-A26A-D61C587B86BD}) (Version: 3.7.4 - Buyond GmbH)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3090 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.3.1427 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Intelligent Touchpad (HKLM-x32\...\{FDB0A81A-1173-4B15-BEA4-89FEA0474F17}) (Version: 1.00.0108 - Lenovo)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.11.1206.1 - Vimicro)
Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.9 - Lenovo)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0.3807 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.0.3807 - CyberLink Corp.) Hidden
Lenovo Registration (HKLM-x32\...\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}) (Version: 1.0.4 - Lenovo Inc.)
Lenovo Smart Update (HKLM-x32\...\{29B7C0EB-A1E6-4BC3-8344-70EDE4F189F1}) (Version: 1.1.30 - Lenovo Corporation)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3728 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
LenovoDrv_x64 (HKLM\...\{83E68458-AF28-4CA4-8AFC-595A10307290}) (Version: 1.0.00 - Lenovo)
Lexware Elster (HKLM-x32\...\{CEF3D480-E4A5-4962-BCF5-D72F355B4E98}) (Version: 14.02.00.0015 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (x32 Version: 4.01.00.0077 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware Installations Dienst (HKLM-x32\...\{F40A1497-1339-49BE-BF28-41FFBCB59E3F}) (Version: 3.02.00.0016 - Haufe-Lexware GmbH & Co.KG)
Lexware lohn+gehalt 2014 (HKLM-x32\...\{45419170-a070-49b9-a935-566c9f6c8ddf}) (Version: 18.0.0.106 - Haufe-Lexware GmbH & Co.KG)
Lexware lohn+gehalt 2014 (x32 Version: 18.04.00.0221 - Haufe-Lexware GmbH & Co.KG) Hidden
Lexware online banking (HKLM-x32\...\{7F603892-89C9-4EC4-9236-7AD4A798EA41}) (Version: 21.00.00.0039 - Haufe-Lexware GmbH & Co.KG)
LockKey (HKLM-x32\...\InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}) (Version: 1.38.2.1 - Lenovo)
LockKey (x32 Version: 1.38.2.1 - Lenovo) Hidden
Logitech Unifying-Software 2.10 (HKLM\...\Logitech Unifying) (Version: 2.10.37 - Logitech)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.2.0 - Mozilla)
Mozilla Thunderbird 31.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.2.0 (x86 de)) (Version: 31.2.0 - Mozilla)
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
Office Trial Extender (HKLM-x32\...\{F18ADBD4-320F-4A67-9709-0FE9412BB0FA}_is1) (Version: 1.0.0.7 - pXc-coding.com)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QuickStart (HKLM-x32\...\InstallShield_{36B0DC39-3282-40EB-8587-B875CE46C3A7}) (Version: 3.3.2.33 - VideACE Co.)
QuickStart (x32 Version: 3.3.2.33 - VideACE Co.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.54.309.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.39019 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Revo Uninstaller Pro 3.1.1 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.1 - VS Revo Group, Ltd.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3392072093-3665888848-192803557-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
sv.net (HKLM-x32\...\sv.net) (Version: 14.0 - ITSG GmbH)
TERRATEC Cinergy Hybrid Stick (64 Bit) (HKLM-x32\...\{53DE5511-BBC4-441D-AD55-6B8E23A3AA05}) (Version: 1.00.08.06 - TERRATEC Electronic GmbH)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.1230 - Lenovo)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Driver Package - Lenovo Corporation (LAD) System  (01/13/2012 1.0.0.2) (HKLM\...\5E61CDC4058A17FE9BE3046B1846F3118CD618B1) (Version: 01/13/2012 1.0.0.2 - Lenovo Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
Windows-Treiberpaket - TerraTec  (TTHID) HIDClass  (05/21/2009 1.00.01.05) (HKLM\...\7051B1F240802F891754E1EFC6431B0D98C2DA65) (Version: 05/21/2009 1.00.01.05 - TerraTec )
Windows-Treiberpaket - TerraTec  (UDXTTM6010) Media  (05/14/2009 1.00.08.06) (HKLM\...\FCC6C304DBC4CB7CFCC0BEF0BCE1BEC491CD289D) (Version: 05/14/2009 1.00.08.06 - TerraTec )
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3392072093-3665888848-192803557-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

02-01-2015 11:42:28 Windows Update
04-01-2015 23:21:28 Windows-Sicherung
06-01-2015 13:39:10 Windows Update
12-01-2015 10:20:30 Windows-Sicherung
14-01-2015 22:22:32 Windows Update
19-01-2015 07:35:44 Windows-Sicherung
20-01-2015 08:55:00 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0DE6B6B7-40F8-4FEC-83FE-1216C32F1722} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {1A7F141E-6586-4065-B81D-0C3F5E8896AC} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [2013-10-17] (Haufe-Lexware GmbH & Co. KG)
Task: {34181D99-9194-4533-9337-049720EDAEF9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {3CF7A384-D880-4C10-A30C-10DE8BC4AE9A} - System32\Tasks\Absolute Reminder => C:\Program Files (x86)\Absolute Software\Absolute Reminder\AbsoluteReminder.exe [2011-07-12] (Absolute Software)
Task: {458FB7D0-196A-4D5C-8C71-85C52183A791} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {482551A7-02EF-4BD8-BDAB-7917336C0864} - System32\Tasks\{A86E2EAC-4F55-4F24-8D01-B5EC4F1943F4} => Chrome.exe 
Task: {54CEA39E-6D75-4A9B-A453-B8E83A8B7F5E} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
Task: {57CB3CD4-AF8E-4875-918C-7C265FA57460} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5E18AC64-F2CC-4C74-AC98-92FC1D1C0CCD} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {7C0BD3B8-372E-46C3-ABDD-962B26735DF1} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2013-12-18] (AVG)
Task: {94607EFC-BBE2-4F8E-AF39-C79E44CBE998} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {9D958EBD-6395-4B59-BF33-8883A20892FC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {DD463A05-C133-4CAC-BEBE-5C6A31AFC1CD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {F51D985B-E3DA-44F5-801F-9580C27BB6D3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-10-17 15:28 - 2013-10-17 15:27 - 00239968 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2014-11-23 13:15 - 2005-04-22 13:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2013-12-18 09:38 - 2013-12-18 09:38 - 00742200 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2011-03-25 16:55 - 2011-03-25 16:55 - 00091464 _____ () C:\QuickStartUtil\VAWinService.exe
2012-08-21 07:57 - 2012-08-21 07:57 - 01508192 _____ () C:\Windows\system32\IcnOvrly.dll
2012-08-21 07:57 - 2012-08-21 07:57 - 00628064 _____ () C:\Windows\system32\SimpleExt.dll
2008-12-20 02:20 - 2012-08-21 08:05 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-04-19 15:22 - 2012-08-21 08:05 - 01516592 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 15:31 - 2012-08-21 08:05 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 02:20 - 2012-08-21 08:05 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2011-03-14 16:27 - 2011-03-14 16:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2012-03-05 03:43 - 2012-03-05 03:43 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-08-21 07:52 - 2011-12-08 10:12 - 00291272 _____ () C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe
2012-06-04 12:04 - 2012-06-04 12:04 - 00045480 _____ () C:\QuickStartUtil\VAWinAgent.exe
2012-06-18 05:37 - 2012-03-26 10:33 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2015-01-20 16:50 - 2015-01-20 16:50 - 00050477 _____ () C:\Users\Astrid \Downloads\Defogger (1).exe
2013-10-17 15:28 - 2013-10-17 15:27 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2013-10-17 15:28 - 2013-10-17 15:27 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2013-10-17 15:28 - 2013-10-17 15:27 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2013-10-17 15:28 - 2013-10-17 15:27 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2013-10-17 15:28 - 2013-10-17 15:27 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll
2013-10-17 15:28 - 2013-10-17 15:27 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll
2011-03-25 16:55 - 2011-03-25 16:55 - 00157000 _____ () C:\QuickStartUtil\libexpat.dll
2011-03-25 16:55 - 2011-03-25 16:55 - 00061768 _____ () C:\QuickStartUtil\netProfileDatabase.DLL
2012-08-21 07:57 - 2012-08-21 07:57 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2013-05-21 11:27 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Astrid \AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-01-20 16:13 - 2015-01-20 16:13 - 00043008 _____ () c:\Users\Astrid \AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7ewslq.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Astrid \AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Astrid \AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Astrid \AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-01-18 12:41 - 2015-01-09 01:35 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libglesv2.dll
2015-01-18 12:41 - 2015-01-09 01:35 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libegl.dll
2015-01-18 12:41 - 2015-01-09 01:35 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\pdf.dll
2015-01-18 12:41 - 2015-01-09 01:35 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\ffmpegsumo.dll
2012-08-21 07:23 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-18 12:41 - 2015-01-09 01:35 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\PepperFlash\pepflashplayer.dll
2012-08-21 07:09 - 2012-02-21 11:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Astrid \Downloads\avira_free_antivirus_de_14.0.6.570.exe:BDU
AlternateDataStreams: C:\Users\Astrid \Downloads\Boot & Fun 2014.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3392072093-3665888848-192803557-500 - Administrator - Disabled)
Astrid (S-1-5-21-3392072093-3665888848-192803557-1000 - Administrator - Enabled) => C:\Users\Astrid 
Gast (S-1-5-21-3392072093-3665888848-192803557-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: BitDefender Firewall NDIS 6 Filter Driver
Description: BitDefender Firewall NDIS 6 Filter Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: BdfNdisf
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/20/2015 04:11:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get Poicy Open key suc failed with 0, The Code is:0x422.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.).

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).


System errors:
=============
Error: (01/20/2015 04:10:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
BdfNdisf
cdrom

Error: (01/20/2015 04:10:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/20/2015 04:10:10 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.

Error: (01/20/2015 04:09:56 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: Das System kann den angegebenen Pfad nicht finden.


Microsoft Office Sessions:
=========================
Error: (01/20/2015 04:11:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---query POLICYVT key success failed with 0, The Code is:0x424.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---Get Poicy Open key suc failed with 0, The Code is:0x422.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---query FLAG_AUTO_SVC_CHANGED key success failed with 1, The Code is:0x424.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---Get FLAG_AUTO_SVC_CHANGED Open key suc failed with 0, The Code is:0x422.

Error: (01/20/2015 04:11:06 PM) (Source: BootShieldSvc) (EventID: 256) (User: )
Description: BootShieldSvc---query POLICYVT key success failed with 0, The Code is:0x424.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2365M CPU @ 1.40GHz
Percentage of memory in use: 73%
Total physical RAM: 3996.36 MB
Available physical RAM: 1044.85 MB
Total Pagefile: 7990.9 MB
Available Pagefile: 3917.29 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:420.56 GB) (Free:241.57 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:20.55 GB) NTFS
Drive e: (USB20FD) (Removable) (Total:3.77 GB) (Free:1.08 GB) FAT32
Drive g: (TOSHIBA EXT) (Fixed) (Total:931.51 GB) (Free:433.15 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 9A6A9913)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=420.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25.5 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=19.5 GB) - (Type=12)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 5DA13049)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 3.8 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=3.8 GB) - (Type=0C)

==================== End Of Log ============================

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-20 18:19:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST500LT0 rev.0001 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ASTRID~1\AppData\Local\Temp\uftiqpow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448                                                                                                                                                                                                            fffff800035fa000 45 bytes [00, 00, 09, 02, 56, 61, 64, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495                                                                                                                                                                                                            fffff800035fa02f 17 bytes [00, 01, 0A, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

?         C:\Windows\system32\mssprxy.dll [2920] entry point in ".rdata" section                                                                                                                                                                                                        00000000745371e6
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                            00000000762d1401 2 bytes JMP 74c8b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                              00000000762d1419 2 bytes JMP 74c8b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                            00000000762d1431 2 bytes JMP 74d08ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                            00000000762d144a 2 bytes CALL 74c648ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                                           * 9
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                               00000000762d14dd 2 bytes JMP 74d087a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                        00000000762d14f5 2 bytes JMP 74d08978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                               00000000762d150d 2 bytes JMP 74d08698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                        00000000762d1525 2 bytes JMP 74d08a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                              00000000762d153d 2 bytes JMP 74c7fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                                   00000000762d1555 2 bytes JMP 74c868ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                            00000000762d156d 2 bytes JMP 74d08f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                              00000000762d1585 2 bytes JMP 74d08ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                                 00000000762d159d 2 bytes JMP 74d0865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                              00000000762d15b5 2 bytes JMP 74c7fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                            00000000762d15cd 2 bytes JMP 74c8b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                        00000000762d16b2 2 bytes JMP 74d08e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                        00000000762d16bd 2 bytes JMP 74d085f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                                                                                                                00000000762d1401 2 bytes JMP 74c8b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                                                                                                                  00000000762d1419 2 bytes JMP 74c8b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                                                                                                                00000000762d1431 2 bytes JMP 74d08ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                                                                                                                00000000762d144a 2 bytes CALL 74c648ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                                           * 9
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                                                                                                                   00000000762d14dd 2 bytes JMP 74d087a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                            00000000762d14f5 2 bytes JMP 74d08978 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                                                                                                                   00000000762d150d 2 bytes JMP 74d08698 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                            00000000762d1525 2 bytes JMP 74d08a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                                                                                                                  00000000762d153d 2 bytes JMP 74c7fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                                                                                                       00000000762d1555 2 bytes JMP 74c868ef C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                                00000000762d156d 2 bytes JMP 74d08f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                                                                                                                  00000000762d1585 2 bytes JMP 74d08ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                                                                                                     00000000762d159d 2 bytes JMP 74d0865c C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                                                                                                                  00000000762d15b5 2 bytes JMP 74c7fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                                                                                                                00000000762d15cd 2 bytes JMP 74c8b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                            00000000762d16b2 2 bytes JMP 74d08e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe[7008] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                            00000000762d16bd 2 bytes JMP 74d085f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                       00000000762d1401 2 bytes JMP 74c8b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                         00000000762d1419 2 bytes JMP 74c8b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                       00000000762d1431 2 bytes JMP 74d08ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                       00000000762d144a 2 bytes CALL 74c648ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                                           * 9
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                          00000000762d14dd 2 bytes JMP 74d087a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                   00000000762d14f5 2 bytes JMP 74d08978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                          00000000762d150d 2 bytes JMP 74d08698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                   00000000762d1525 2 bytes JMP 74d08a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                         00000000762d153d 2 bytes JMP 74c7fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                              00000000762d1555 2 bytes JMP 74c868ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                       00000000762d156d 2 bytes JMP 74d08f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                         00000000762d1585 2 bytes JMP 74d08ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                            00000000762d159d 2 bytes JMP 74d0865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                         00000000762d15b5 2 bytes JMP 74c7fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                       00000000762d15cd 2 bytes JMP 74c8b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                   00000000762d16b2 2 bytes JMP 74d08e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                   00000000762d16bd 2 bytes JMP 74d085f1 C:\Windows\syswow64\kernel32.dll
?         C:\Windows\system32\mssprxy.dll [2580] entry point in ".rdata" section                                                                                                                                                                                                        00000000745371e6

---- Threads - GMER 2.1 ----

Thread    C:\Windows\SysWOW64\ntdll.dll [1940:1944]                                                                                                                                                                                                                                     000000000003c18f
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:2076]                                                                                                                                                                                                                                     0000000072918f48
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:2112]                                                                                                                                                                                                                                     0000000072918f48
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:2116]                                                                                                                                                                                                                                     0000000072aa1c10
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:3744]                                                                                                                                                                                                                                     0000000064c75880
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:3740]                                                                                                                                                                                                                                     0000000064c75880
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:3748]                                                                                                                                                                                                                                     0000000064c75880
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:3784]                                                                                                                                                                                                                                     0000000064c73520
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:3804]                                                                                                                                                                                                                                     0000000065123e60
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:6840]                                                                                                                                                                                                                                     0000000071b75590
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:2432]                                                                                                                                                                                                                                     0000000071b75d70
Thread    C:\Windows\SysWOW64\ntdll.dll [1940:4016]                                                                                                                                                                                                                                     0000000072cae69f
---- Processes - GMER 2.1 ----

Library   C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                                 000000006fbc0000
Library   C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                           000000006e940000
Library   C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                                  000000006a1c0000
Library   C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                               000000006ff00000
Library   C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                            000000006efc0000
Library   C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2400](2013-10-17 14:28:24)                                                                                                                   000000006ed40000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46)        0000000058e50000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)            0000000058b10000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008](2014-10-22 00:22:50)                                                                                        0000000058a50000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)           0000000058660000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (ICU I18N DLL/The ICU Project)(2014-10-22 00:22:50)                                                           000000004a900000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (ICU Common DLL/The ICU Project)(2014-10-22 00:22:50)                                                         0000000004590000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (ICU Data DLL/The ICU Project)(2014-10-22 00:22:50)                                                           000000004ad00000
Library   c:\users\astrid~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7ewslq.dll (*** suspicious ***) @ C:\Users\Astrid Böttcher\AppData\Roaming\Dropbox\bin\Dropbox.exe [7008](2015-01-20 15:13:08)                                              0000000003ff0000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)        0000000051c90000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)         0000000050c20000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)          0000000050a00000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)            00000000507a0000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)            0000000051c60000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008](2014-10-22 00:22:50)                                                                                           0000000059680000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46)  0000000050770000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)         0000000050730000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)   00000000506e0000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008](2014-10-22 00:22:48)                                                                       0000000050600000
Library   C:\Users\Astrid \AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Astrid \AppData\Roaming\Dropbox\bin\Dropbox.exe [7008](2014-10-22 00:22:46)                                                                       0000000051fc0000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74e543fb024d                                                                                                                                                                                                   
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74e543fb024d (not active ControlSet)                                                                                                                                                                               

---- EOF - GMER 2.1 ----